A reflected Cross-site Scripting vulnerability in the Stefan M. SMu Manual DoFollow plugin allows unauthenticated attackers to execute arbitrary scripts in a user's browser.

This is a reflected Cross-site Scripting (CWE-79) vulnerability where the plugin fails to sanitize input during web page generation. An unauthenticated attacker can trigger this flaw by enticing a user to interact with a malicious link.

Successful exploitation allows an attacker to execute unauthorized JavaScript within the context of the victim's session. This can lead to the theft of session cookies, unauthorized actions performed on behalf of the user, or redirection to malicious sites, which may result in significant reputational damage and loss of administrative control. The CVSS score of 7.1 indicates a high severity, particularly due to the impact on the Confidentiality and Integrity of the affected session.

Immediate Action: Since no specific patch version is currently identified, users should deactivate and remove the SMu Manual DoFollow plugin from their WordPress environment until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for requests containing suspicious script tags or encoded characters in URL parameters that target the plugin's endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to identify and block malicious payloads directed at the vulnerable parameters.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of XSS vulnerabilities, the risk of session compromise is significant. Organizations using this plugin should prioritize its removal or restriction until the developer provides a verified security update, as manual sanitization of plugin code is not recommended for production environments.