This vulnerability in the WP Front User Submit / Front Editor plugin (versions <= 4.9.3) allows reflected cross-site scripting due to improper input neutralization during web page generation. An attacker can craft a malicious link that, when visited by a user, executes arbitrary scripts in the user's browser context. The CVSS 3.1 score of 7.1 reflects a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official patch or remediation guidance from the vendor at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, exploitation requires user interaction (clicking a crafted link). There are no known active exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution with untrusted input and links related to the affected plugin. Consider disabling or removing the plugin if feasible to reduce exposure. Monitor official vendor channels for updates and apply patches promptly once released.