CVE-2024-11458 is a reflected cross-site scripting vulnerability in the FAQ Builder AYS WordPress plugin affecting all versions up to and including 1.7.1. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'ays_faq_tab' parameter. An unauthenticated attacker can exploit this by crafting a URL that injects malicious scripts, which execute when a user interacts with the link. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected website for users who click on a malicious link. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no direct impact on availability. The vulnerability does not require authentication but does require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the FAQ Builder AYS plugin or implementing web application firewall (WAF) rules to filter malicious input targeting the 'ays_faq_tab' parameter. Educate users to avoid clicking suspicious links related to the affected site.