The ifeelweb Post Status Notifier WordPress plugins (Lite and Premium) versions up to 1.11.6 contain a reflected XSS vulnerability via the 'page' parameter. This occurs due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping. An unauthenticated attacker can exploit this by crafting a URL that injects arbitrary web scripts, which execute when a user interacts with the malicious link. The vulnerability is tracked as CVE-2024-10048 with a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser session, potentially resulting in limited confidentiality and integrity impacts such as theft of user data or session tokens. Availability is not affected. The attacker does not require authentication but must convince a user to click a malicious link. The vulnerability affects all versions up to and including 1.11.6 of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin or applying manual input sanitization if feasible. Additionally, users should be cautious about clicking untrusted links that may exploit this vulnerability.