The Goodlayers Core plugin for WordPress contains a reflected XSS vulnerability identified as CVE-2024-11200. This vulnerability is due to improper neutralization of input in the 'font-family' parameter, which is not sufficiently sanitized or escaped before being used in web page generation. As a result, attackers can inject malicious scripts that execute in the context of a victim's browser when they interact with a crafted URL. The vulnerability affects all versions up to and including 2.0.7. It requires no privileges and no authentication, but user interaction is necessary. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to theft of sensitive information, session hijacking, or other malicious actions limited to the scope of the affected web application. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking on suspicious links that may exploit this vulnerability and consider disabling or replacing the Goodlayers Core plugin if feasible. Monitor official GoodLayers communications for updates and apply patches promptly once available.