The Vzaar Media Management plugin for WordPress versions up to 1.2 suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in the $_SERVER['PHP_SELF'] variable. This allows unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted URL. The vulnerability is identified as CWE-79 and has a CVSS 3.1 base score of 5.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed for the vulnerability to be present (though user interaction is needed for exploitation). No patch or remediation details are currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to actions such as session hijacking or redirection to malicious sites. However, the CVSS impact metrics indicate no confidentiality or availability impact, only integrity impact at a low level. The vulnerability requires user interaction (clicking a crafted link) for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin version. Additionally, applying web application firewall (WAF) rules that detect and block reflected XSS attempts targeting the $_SERVER['PHP_SELF'] parameter may help mitigate risk.