CVE-2024-11402 describes a reflected cross-site scripting vulnerability in the kubiq Block Editor Bootstrap Blocks WordPress plugin, versions up to 6.6.1. The issue is caused by improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that execute in users' browsers when they interact with crafted content. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. There is no vendor advisory or patch link currently available, and no known exploits have been reported.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser session, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS score of 7.1 indicates a high severity level with partial impact on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using untrusted input in contexts rendered by the affected plugin and consider disabling or replacing the plugin if possible. Monitor kubiq's official channels for updates and apply patches promptly once available.