The Accounting for WooCommerce plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to the use of add_query_arg without proper escaping of URL parameters in all versions up to 1.6.6. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link. The vulnerability is tracked as CVE-2024-11324 with a CVSS 3.1 base score of 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability. No patch or remediation details are currently provided by the vendor or in public advisories.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website, potentially leading to information disclosure and integrity impacts such as session hijacking or unauthorized actions performed by the user. Availability is not impacted. The vulnerability requires user interaction (clicking a malicious link) and does not require privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts targeting this plugin. Monitoring for updates from the vendor bastho is recommended to apply any forthcoming patches promptly.