An unauthenticated Cross-Site Scripting (XSS) vulnerability in the Supsystic Digital Publications plugin for WordPress allows attackers to execute malicious scripts in user browsers.

The plugin fails to properly neutralize user-supplied input during web page generation (CWE-79). This allows an unauthenticated attacker to inject malicious client-side scripts, which will execute in the context of the victim's session.

This vulnerability enables attackers to perform session hijacking, redirect users to malicious sites, or steal sensitive cookies and tokens. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to user data and the overall reputation of the website hosting the plugin.

Immediate Action: Update the Supsystic Digital Publications plugin to the latest version. If an update is not available, deactivate or remove the plugin until a fix is provided.

Proactive Monitoring: Review web application logs for suspicious URL parameters containing script tags or encoded characters indicative of XSS attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rules to block common XSS injection patterns.

Public Exploit Available: Yes — an ExploitDB entry exists.

Given the ease of exploitation and the potential for unauthorized script execution, users should prioritize patching or removing the affected plugin immediately to protect site visitors.