This vulnerability involves improper neutralization of input in the RealMag777 MDTF WordPress plugin, leading to a cross-site scripting (XSS) issue. It affects versions up to and including 1.3.3.8. The vulnerability requires network access, low attack complexity, low privileges, and user interaction, and it impacts confidentiality, integrity, and availability to a limited extent. No vendor advisory or patch information is provided, and the vulnerability is publicly disclosed as of October 22, 2025.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited confidentiality, integrity, and availability impacts. This could result in unauthorized actions performed on behalf of a user or disclosure of sensitive information within the application context. However, the attack requires user interaction and low privileges, which somewhat limits the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting plugin usage to trusted users and monitoring for suspicious activity related to this plugin. Avoid clicking on untrusted links that may trigger the vulnerability.