CVE-2024-0665 is a reflected cross-site scripting vulnerability in the WP Customer Area plugin for WordPress, affecting all versions up to and including 8.2.1. The issue is due to improper neutralization of input in the 'tab' parameter, which is not sufficiently sanitized or escaped before being included in web pages. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a malicious link. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected site, potentially allowing attackers to steal user session data, perform actions on behalf of the user, or manipulate site content. The impact affects confidentiality and integrity but does not affect availability. Since the attack requires user interaction and no privileges, it poses a moderate risk to users of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality if possible. Additionally, educating users to avoid clicking suspicious links related to the affected site can reduce risk. Monitor the vendor's communications for updates on patches or official mitigations.