CVE-2024-11329 is a reflected cross-site scripting vulnerability in the Comfino Payment Gateway WordPress plugin caused by improper neutralization of input during web page generation. The issue stems from the use of add_query_arg and remove_query_arg functions without proper escaping of URL parameters, enabling injection of arbitrary web scripts. This affects all versions up to and including 4.1.1. An unauthenticated attacker can exploit this by crafting a malicious URL and convincing a user to click it, resulting in script execution within the victim's browser context.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected website for users who click on a maliciously crafted link. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of displayed content. There is no reported impact on availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — no official fix or patch information is currently available. Users of the Comfino Payment Gateway plugin should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts targeting this plugin. Avoid clicking on suspicious links related to the affected site.