CVE-2024-11331 describes a reflected Cross-Site Scripting vulnerability in the استخراج محصولات ووکامرس برای آیسی WordPress plugin (versions up to 2.1.3). The issue arises from the plugin's use of add_query_arg and remove_query_arg functions without proper escaping of URL parameters, enabling injection of malicious scripts. An unauthenticated attacker can exploit this by crafting a URL that, when visited by a user, executes arbitrary JavaScript in the context of the affected site. This vulnerability impacts confidentiality and integrity but does not affect availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the vulnerable site, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or manipulate site content. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking suspicious links related to the affected plugin and consider disabling or removing the plugin if possible. Monitor the vendor's channels for updates and apply any official patches promptly once available.