The Grand Conference Theme Custom Post Type is vulnerable to reflected cross-site scripting, which could allow an unauthenticated attacker to execute arbitrary scripts in a user's browser.

This is a reflected cross-site scripting (XSS) flaw categorized as CWE-79, caused by improper neutralization of user-supplied input within the grandconference-custom-post component. The vulnerability is exploitable by an unauthenticated attacker via a web browser.

Successful exploitation allows an attacker to execute malicious JavaScript within the context of a victim's session, potentially leading to session hijacking, unauthorized actions, or the theft of sensitive user data. With a CVSS score of 7.1, this represents a high-severity risk that could compromise the integrity and confidentiality of the affected WordPress environment.

Immediate Action: Users should update the Grand Conference Theme Custom Post Type to version 2.6.4 or later if available, or discontinue use of the plugin until a secure version is confirmed.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous URL parameters containing script tags or encoded JavaScript payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to inspect incoming requests and block malicious payloads targeting the custom post type parameters.

Public Exploit Available: No (exploit_available: false)

This reflected XSS vulnerability poses a significant risk to site visitors and administrators. Organizations should prioritize updating to the patched version as soon as the vendor makes it available and implement WAF rules to mitigate the exposure until the patch can be deployed across all affected instances.