A reflected cross-site scripting vulnerability in the Rentsyst WordPress plugin allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

This vulnerability is a Reflected Cross-Site Scripting (XSS) flaw occurring within the Rentsyst plugin. The vulnerability allows an unauthenticated attacker to inject malicious scripts into web pages, which are then executed in the victim's browser.

Successful exploitation of this flaw can lead to unauthorized actions performed on behalf of authenticated users, such as session hijacking or the theft of sensitive session cookies. Given the CVSS score of 7.1, this is classified as a High severity issue that poses a significant risk to user data integrity and account security.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and remove the Rentsyst plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor web application logs for suspicious URL parameters containing script tags or encoded characters that may indicate XSS probing attempts.

Compensating Controls: Implement a strict Content Security Policy (CSP) and utilize a Web Application Firewall (WAF) to filter and block malicious script injection attempts at the edge.

Public Exploit Available: Unknown.

The presence of a Reflected XSS vulnerability in an active plugin requires immediate administrative attention to prevent potential account compromise. Organizations should prioritize the removal of the Rentsyst plugin until the vendor provides a confirmed secure update, ensuring that user sessions remain protected from script injection attacks.