Digital License Manager Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Digital License Manager plugin for WordPress, affecting all versions through 1.7.3. The issue arises from the use of the remove_query_arg() function without proper escaping, allowing unauthenticated attackers to inject arbitrary scripts. These scripts could be executed if a user is tricked into clicking a manipulated link.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject scripts that are executed in the context of the user's browser.

Remediation

Users can update to version 1.7.4 or a newer patched version to address this vulnerability.