CVE-2024-11277 is a reflected cross-site scripting vulnerability in the 404 Solution plugin for WordPress, affecting all versions up to and including 2.35.19. The vulnerability arises from insufficient sanitization and escaping of URL input, enabling unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they interact with a crafted URL. This can lead to limited confidentiality and integrity impacts, with no availability impact noted. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's browser session when the victim clicks a crafted link. This can lead to limited disclosure of information and modification of data accessible to the user. There is no direct impact on system availability. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links received from untrusted sources and consider disabling or replacing the 404 Solution plugin if possible. Monitor official channels for updates regarding patches or mitigations.