The Use-your-Drive | Google Drive plugin for WordPress contains a stored XSS vulnerability (CWE-79) via the 'title' parameter in file metadata. This occurs due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping. Attackers can inject arbitrary web scripts that execute when users access the affected pages. The vulnerability can be exploited by users with the lowest upload permissions, including unauthenticated users if the upload shortcode is exposed publicly. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix information is available in the provided data.

Successful exploitation allows attackers to execute arbitrary scripts in the context of users visiting the affected WordPress site, potentially leading to theft of sensitive information, session hijacking, or other malicious actions limited to confidentiality and integrity impacts. The vulnerability does not affect availability. Because the attack can be performed by unauthenticated users if the upload shortcode is public, the risk is elevated on publicly accessible sites using vulnerable plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions to trusted users only and avoid publishing file upload shortcodes on publicly accessible posts. Monitor vendor channels for updates and apply patches promptly once available.