CVE-2024-11686 is a reflected cross-site scripting vulnerability in the manycontacts WhatsApp 🚀 click to chat plugin for WordPress. The flaw exists in the handling of the 'manycontacts_code' parameter, which lacks proper input sanitization and output escaping. This allows attackers to inject malicious scripts that execute in the context of the affected website when a user interacts with a crafted link. The vulnerability affects all versions up to and including 3.0.4 and does not require authentication. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and limited confidentiality and integrity impacts.

Successful exploitation can lead to execution of arbitrary scripts in the context of the vulnerable website for users who click on malicious links. This can result in limited confidentiality and integrity impacts such as theft of user session data or manipulation of displayed content. There is no impact on availability. The vulnerability does not require authentication and can be exploited remotely via crafted URLs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links involving the 'manycontacts_code' parameter. Website administrators should monitor for updates from the manycontacts plugin vendor and apply patches promptly once released. No official patch or temporary fix information is currently provided.