CVE-2024-11405 is a reflected cross-site scripting vulnerability in the WP Front-end login and register plugin for WordPress, affecting all versions up to 2.1.0. The vulnerability is due to improper neutralization of input during web page generation (CWE-79), specifically in the email and wpmp_reset_password_token parameters. An unauthenticated attacker can craft malicious URLs that, when clicked by a user, execute arbitrary scripts in the context of the victim's browser session. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N).

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim user’s browser, potentially leading to theft of sensitive information or session tokens. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is documented, users should monitor for updates from the plugin vendor. Until a fix is available, consider disabling or restricting access to the affected plugin functionality to reduce exposure.