The ProSolution WP Client WordPress plugin versions prior to 2.0.11 contain a reflected XSS vulnerability (CWE-79). The vulnerability exists due to improper sanitization and escaping of a parameter that is reflected into an HTML attribute on an administrative page. This can lead to script execution in the administrator's session when a crafted request is submitted. No CVSS score or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an administrator's session, potentially leading to session hijacking, privilege escalation, or other administrative actions performed under the administrator's credentials. However, no active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted inputs or links that could trigger this vulnerability. Monitor vendor channels for updates regarding patches or official mitigations.