Draft a response to a security researcher's vulnerability disclosure

Email received this morning:

["I found a stored XSS in the comment form on [yoursite.com]. An unauthenticated
user can submit a crafted comment that executes arbitrary JavaScript when an
admin views it in wp-admin, which can be used to hijack an admin session. I've
attached a proof-of-concept comment payload. Per my personal disclosure policy
I intend to publish details in 90 days regardless of whether you've responded."]

The finding looks credible after a quick internal check: it does trace to how a
specific plugin sanitizes comment content before rendering it in the admin
comment moderation screen.

Draft the response and the internal plan:
1. The reply to the researcher: acknowledge receipt same day, confirm you're
   investigating, don't get defensive or imply legal action, ask any clarifying
   questions needed to reproduce it (WordPress version, plugin version, exact
   payload used if not already fully specified), and propose a realistic
   timeline for a fix given the 90-day window.
2. Internally, sequence the response: reproduce on a staging copy first, assess
   real-world exposure (is this plugin active on other sites you manage, is the
   comment form open to the public or gated), and decide between a quick
   mitigating patch (escaping the specific field) versus waiting for an upstream
   plugin fix if one is already in progress.
3. Decide and state whether to offer public credit to the researcher once fixed,
   since that's standard practice and affects how the eventual public disclosure
   reads for your site.
4. Set the actual internal deadline you're working toward, distinct from the
   researcher's 90 days, and what you'll do if you can't hit it: request a
   short extension from the researcher with a specific reason, rather than
   going silent as the deadline approaches.