CVE-2024-11435 is a reflected cross-site scripting vulnerability in the goback2 salavat counter Plugin for WordPress. The issue exists due to improper neutralization of input in the 'page' parameter, allowing injection of malicious scripts. This affects all versions up to 0.9.4. The vulnerability requires user interaction (UI:R) and can lead to partial confidentiality and integrity impact (C:L/I:L) but no availability impact. No patch or remediation guidance is currently provided by the vendor or in public advisories.

An unauthenticated attacker can exploit this vulnerability by crafting a malicious link that injects arbitrary scripts into the affected web pages. If a user clicks the link, the injected script executes in the user's browser context, potentially leading to theft of sensitive information or manipulation of the webpage content. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the salavat counter Plugin or implementing web application firewall (WAF) rules to block malicious input targeting the 'page' parameter. Avoid clicking on suspicious links that may exploit this vulnerability.