This vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder (up to version 1.2.0) involves improper neutralization of input during web page generation, leading to reflected cross-site scripting (XSS). This allows attackers to inject malicious scripts that execute in the context of users viewing the affected web pages. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of user data. The CVSS score of 7.1 reflects a high impact but requires user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted inputs or links related to the affected product. Monitor for updates from VillaTheme regarding patches or mitigations.