CVE-2024-11418 is a reflected cross-site scripting vulnerability in the Additional Order Filters for WooCommerce plugin for WordPress, affecting all versions up to and including 1.21. The issue is caused by improper neutralization of input in the 'shipping_method_filter' parameter, which lacks sufficient sanitization and output escaping. This allows unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted link. The vulnerability has a CVSS 3.1 base score of 6.1, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, hijack user sessions, or perform actions on behalf of the user. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid interacting with suspicious links that include the 'shipping_method_filter' parameter. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.