CVE-2024-10792 is a reflected Cross-Site Scripting vulnerability (CWE-79) in the WPFunnels plugin for WordPress and WooCommerce. The vulnerability exists due to improper neutralization of input in the 'post_id' parameter, allowing injection of arbitrary web scripts. This affects all plugin versions up to and including 3.5.5. The vulnerability enables unauthenticated attackers to craft malicious links that, when clicked by users, execute injected scripts in the context of the victim's browser session. The issue was partially addressed in version 3.5.4 and fully patched in version 3.5.5. The CVSS v3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure or manipulation of web content. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Upgrade the WPFunnels plugin to version 3.5.5 or later, where the vulnerability is fully patched. Versions prior to 3.5.5 are vulnerable. No additional mitigation steps are indicated by the vendor advisory.