The custom-post-edit plugin for WordPress is vulnerable to reflected cross-site scripting, which could allow an unauthenticated attacker to execute arbitrary scripts in a user's browser.

This is a reflected cross-site scripting (XSS) vulnerability occurring due to improper neutralization of input during web page generation. An unauthenticated attacker can trigger the execution of malicious scripts within the context of a victim's session by injecting input into the front-end-post-edit component.

Successful exploitation of this flaw could allow an attacker to hijack user sessions, steal sensitive session cookies, or redirect users to malicious websites. Given the CVSS score of 7.1, this is classified as a high-severity issue that poses a significant risk to organizational data integrity and user privacy. Frequent exploitation of XSS can lead to unauthorized account access and potential degradation of user trust in the affected platform.

Immediate Action: Since no specific patch version is currently listed, users should immediately deactivate and remove the custom-post-edit plugin until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for requests containing unusual script tags or encoded payloads directed at the front-end-post-edit endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules enabled to detect and block malicious payloads targeting this plugin's parameters.

Public Exploit Available: No.

The high CVSS score for this reflected XSS vulnerability necessitates immediate attention from administrators. Because the plugin is currently vulnerable without a confirmed patch, the most effective risk mitigation is the immediate removal of the software from the production environment. Organizations should prioritize decommissioning this plugin to ensure the security of their front-end interfaces.