The vulnerability CVE-2024-11202 affects the creativemindssolutions WordPress plugin 'CM Header and Footer – Add custom scripts and styles to your header and footer with ease.' It is a reflected cross-site scripting (CWE-79) issue caused by improper neutralization of input in the cminds_free_guide shortcode. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if the victim is tricked into clicking a malicious link. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires low attack complexity, no privileges, but requires user interaction, and impacts confidentiality and integrity with no impact on availability. The vulnerability is published and assigned by Wordfence, but no patch or official fix is currently documented.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or manipulation of web content. The impact affects confidentiality and integrity but does not affect availability. Since the attack requires user interaction, the risk is somewhat mitigated by user caution. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with links involving the affected shortcode and consider disabling or removing the vulnerable plugin if possible. Monitor official creativemindssolutions communications for updates or patches addressing this vulnerability.