CVE-2024-11365 is a reflected cross-site scripting vulnerability in the Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes WordPress plugin (up to version 1.1.6). The issue arises from improper neutralization of input during web page generation, specifically due to the use of add_query_arg without appropriate escaping of URL parameters. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a maliciously crafted link. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope change, and limited confidentiality and integrity impact without availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or manipulate site content. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking suspicious links related to the affected plugin. Monitoring for updates from the plugin vendor or WordPress repository is recommended to apply any forthcoming patches promptly.