The Ex-Themes WooTour plugin contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in the context of a user session.

This vulnerability is caused by improper neutralization of user-supplied input during web page generation, specifically within the WooTour plugin. The flaw allows an unauthenticated attacker to perform reflected XSS attacks by injecting scripts that execute in the browser of a victim.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of the user, and the theft of sensitive information. With a CVSS score of 7.1, this represents a high-risk scenario for organizations that rely on this plugin for travel and booking management, as it facilitates direct attacks against site administrators and customers.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and remove the WooTour plugin until a security update is released by Ex-Themes.

Proactive Monitoring: Monitor web server access logs for requests containing suspicious script tags or encoded characters typically associated with XSS payloads.

Compensating Controls: Implement a robust Web Application Firewall (WAF) with configured XSS protection rules to identify and block malicious injection attempts targeting the plugin.

Public Exploit Available: Unknown

The high severity of this reflected XSS vulnerability necessitates immediate attention to prevent unauthorized script execution. Administrators should prioritize deactivating the affected software until the vendor provides a verified security update to address the input neutralization failure.