CVE-2024-11461 describes a reflected Cross-Site Scripting vulnerability in the taunoh Form Data Collector WordPress plugin affecting all versions up to 2.2.3. The issue stems from improper neutralization of input in the 'page' parameter, enabling unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser upon interaction. The vulnerability has a CVSS score of 6.1 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure and integrity compromise of the affected web application session. There is no direct impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin or applying manual input validation and output escaping for the 'page' parameter to mitigate the risk. Monitor vendor channels for updates regarding an official patch.