A critical reflected Cross-Site Scripting vulnerability in the Query Monitor plugin for WordPress allows unauthenticated attackers to execute arbitrary web scripts in the context of a user session.

The flaw exists due to insufficient input sanitization and output escaping within the REQUEST_URI parameter. This allows an unauthenticated attacker to inject malicious scripts that execute when a victim interacts with a crafted link.

Successful exploitation of this vulnerability could lead to unauthorized script execution within the browser of an authenticated administrator or user, potentially resulting in session hijacking or administrative account takeover. Given the high CVSS score of 7.2, this flaw poses a significant risk to site integrity and data confidentiality, as it facilitates the compromise of user sessions without requiring prior authentication.

Immediate Action: Ensure the Query Monitor plugin is removed from production environments if not strictly required for development, or monitor the vendor repository for the release of a patched version beyond 3.20.3.

Proactive Monitoring: Monitor server access logs for anomalous URL patterns containing script tags or suspicious encoded characters directed at the Query Monitor plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust cross-site scripting protection rules to detect and block malicious payloads targeting the REQUEST_URI parameter.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for full administrative account compromise, users should prioritize the immediate removal or restriction of the Query Monitor plugin. If the plugin is essential for development, it must be strictly isolated from production traffic and updated immediately once a vendor patch is released to remediate the underlying sanitization failures.