An unauthenticated Reflected Cross-Site Scripting vulnerability in the IPGP Visitors Origin WordPress plugin allows attackers to execute malicious scripts in the context of a user's browser.

The plugin fails to sanitize or escape user-supplied input before reflecting it back in the HTTP response. An unauthenticated attacker can craft a malicious request that, when clicked by an unsuspecting user, executes arbitrary JavaScript in that user's browser session.

Successful exploitation can lead to session hijacking, the theft of sensitive user data, or unauthorized actions performed on behalf of the victim. With a CVSS score of 7.1, this vulnerability is classified as high severity, particularly if it targets users with administrative privileges within the WordPress environment.

Immediate Action: Update the IPGP Visitors Origin WordPress plugin to version 1.6 or later.

Proactive Monitoring: Review web server logs for suspicious requests containing encoded script tags or unusual parameters directed at the plugin's endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS attack patterns in incoming HTTP requests.

Public Exploit Available: No (exploit_available: false)

Organizations using the IPGP Visitors Origin plugin should prioritize this update. Given the nature of XSS, it is recommended to also clear browser caches and force re-authentication for administrative sessions if there is any suspicion that the plugin may have been targeted.