The Post Grid Master plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in the 'argsArray["read_more_text"]' parameter. This allows unauthenticated attackers to inject malicious scripts that execute when a user clicks a crafted link. The vulnerability affects all versions up to 3.4.13. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal session tokens, perform actions on behalf of users, or conduct phishing attacks. The impact is limited to confidentiality and integrity with no direct availability impact. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, consider disabling or restricting access to the vulnerable parameter if possible, and educate users to avoid clicking suspicious links related to the affected site.