CVE-2024-10684 is a reflected Cross-Site Scripting vulnerability in the Kognetiks Chatbot for WordPress plugin affecting all versions up to and including 2.1.7. The issue is due to improper neutralization of input in the 'dir' parameter, allowing injection of arbitrary web scripts that execute when a user interacts with a malicious link. The vulnerability requires no privileges and involves user interaction, with a CVSS 3.1 base score of 6.1 (medium severity). No known exploits in the wild have been reported, and no patch or remediation details are currently available.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to perform actions such as session hijacking, defacement, or redirecting users to malicious sites. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and no authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin or applying web application firewall (WAF) rules to filter malicious input targeting the 'dir' parameter. Avoid clicking on suspicious links that may exploit this vulnerability.