CVE-2024-10049 is a reflected cross-site scripting vulnerability (CWE-79) in the Edit WooCommerce Templates WordPress plugin by ioannup. The flaw exists in all versions up to and including 1.1.2, where the 'page' parameter is not properly sanitized or escaped before being included in web page output. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if the victim clicks a crafted link. The vulnerability has a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker can perform reflected cross-site scripting attacks by injecting malicious scripts via the vulnerable 'page' parameter. This can lead to limited confidentiality and integrity impacts in the context of the victim's browser session, such as theft of cookies or manipulation of displayed content. The attack requires user interaction (clicking a crafted link) and does not require authentication. There is no indication of availability impact or widespread exploitation at this time.

No official patch or fix is currently available for this vulnerability. Users of the Edit WooCommerce Templates plugin should monitor the vendor's channels for updates or patches. Until a fix is released, consider disabling or removing the plugin if feasible, or applying web application firewall (WAF) rules to block malicious payloads targeting the 'page' parameter. Avoid clicking on suspicious links that may exploit this vulnerability.