CVE-2024-11369 is a reflected cross-site scripting vulnerability in the Store credit / Gift cards for woocommerce WordPress plugin by rajeshsingh520. The flaw exists in all versions up to and including 1.0.49.46, where the 'coupon', 'start_date', and 'end_date' parameters are not properly sanitized or escaped before being included in web pages. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users who interact with crafted URLs. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (medium severity). There is no indication of known exploits in the wild or available patches at this time.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of session tokens, redirection to malicious sites, or other user-targeted attacks. The impact is limited to confidentiality and integrity of user interactions; availability is not affected. Since the vulnerability is reflected XSS and requires user interaction, the attack vector involves social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version or applying custom input validation and output escaping for the vulnerable parameters. Additionally, educating users to avoid clicking suspicious links can reduce risk.