A Reflected Cross-site Scripting vulnerability in the Prasadkirpekar Advanced Custom CSS plugin allows unauthenticated attackers to execute malicious scripts in a user's browser session.

This is a Reflected Cross-site Scripting (CWE-79) vulnerability occurring during web page generation. An unauthenticated attacker can trigger this flaw by crafting a malicious link that forces a victim to execute arbitrary JavaScript within their browser session.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of an authenticated user, and potential redirection to malicious websites. Given the CVSS score of 7.1, this is classified as a High severity issue, as it compromises the integrity and confidentiality of user interactions with the affected WordPress site.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate and remove the Advanced Custom CSS plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests containing script tags or suspicious URL parameters targeting the plugin.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to intercept and block malicious payloads directed at the vulnerable parameters.

Public Exploit Available: No (exploit_available: false).

This vulnerability presents a significant risk to site security by enabling client-side attacks. Organizations should prioritize the removal of the vulnerable plugin from their WordPress environments until the vendor provides a verified security update to address the XSS flaw.