CVE-2024-0509 is a reflected cross-site scripting vulnerability in the WP 404 Auto Redirect to Similar Post plugin for WordPress. The issue exists in all versions up to and including 1.0.3 due to improper neutralization of input in the 'request' parameter. An unauthenticated attacker can exploit this by tricking a user into clicking a malicious link, causing arbitrary script execution in the context of the affected site. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to theft of user credentials, session hijacking, or other malicious actions within the context of the vulnerable website. The vulnerability does not impact system availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to the vulnerable functionality. Additionally, applying web application firewall (WAF) rules that block malicious input targeting the 'request' parameter may help mitigate exploitation risks.