The Arevico WP Tactical Popup plugin for WordPress versions up to 1.1 suffers from a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker to craft malicious URLs that execute arbitrary scripts when visited by users, potentially leading to session hijacking, defacement, or other script-based attacks. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, manipulate site content, or disrupt availability. The impact is rated as high due to the combined effects on confidentiality, integrity, and availability, although exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Tactical Popup plugin or applying any available temporary mitigations recommended by the vendor. Monitoring for updates from Arevico is advised to apply an official patch once available.