CVE-2024-10836 is a reflected cross-site scripting vulnerability (CWE-79) in the Flixita WordPress theme by themesdaddy. The issue occurs due to improper neutralization of input in the ‘id’ parameter, allowing injection of malicious scripts that execute in the context of a victim’s browser when they click a crafted link. This affects all versions up to and including 1.0.82. The vulnerability requires user interaction (clicking a link) and does not require privileges or authentication. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim’s browser session, potentially leading to information disclosure or manipulation of web content. The vulnerability impacts confidentiality and integrity but does not affect availability. It requires user interaction and no authentication, making it a moderate risk for users of the affected theme versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or replacing the Flixita theme or applying custom input sanitization and output escaping for the ‘id’ parameter if feasible. Avoid clicking on suspicious links that may exploit this vulnerability.