CVE-2024-10825 is a reflected cross-site scripting vulnerability (CWE-79) in the Hide My WP Ghost – Security & Firewall plugin for WordPress, affecting all versions up to 5.3.01. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of URL parameters. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrative user interacts with a maliciously crafted URL. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

An attacker can perform reflected XSS attacks by injecting malicious scripts via URL parameters. If an administrative user is tricked into clicking such a link, the injected script executes in their browser context, potentially leading to unauthorized actions or data disclosure limited to the privileges of that user. The vulnerability does not affect availability and has low impact on confidentiality and integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on suspicious links and consider restricting access to the plugin's administrative interface. Monitoring vendor channels for updates is recommended.