The WPFactory MSRP (RRP) Pricing for WooCommerce plugin versions up to 1.8.1 contain a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that execute in the victim's browser when they interact with crafted web content. The vulnerability is remotely exploitable without privileges and requires user interaction. It affects confidentiality, integrity, and availability, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L and a score of 7.1. No patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this reflected XSS vulnerability could allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity level with low attack complexity and no required privileges but requiring user interaction. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted inputs or links related to the affected plugin. Monitor official WPFactory communications for updates and apply patches promptly once released. No official fix or temporary workaround has been documented as of now.