The ThemeGoods Photography plugin versions up to 7.7.2 contain a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a victim interacts with a crafted link or input, potentially leading to partial confidentiality, integrity, and availability impacts as reflected in the CVSS vector. The vulnerability is exploitable remotely without authentication but requires user interaction. No patch or official remediation guidance is currently provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in partial loss of confidentiality, integrity, and availability of user data or session information. The CVSS vector indicates that the impact on confidentiality, integrity, and availability is low to partial but still significant enough to rate the vulnerability as high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by restricting access to the affected plugin or applying web application firewall (WAF) rules to detect and block reflected XSS attempts. Avoid clicking on suspicious links that could trigger the vulnerability.