CVE-2024-11687 is a reflected Cross-Site Scripting vulnerability in the Next-Cart Store to WooCommerce Migration plugin for WordPress, affecting all versions up to 3.9.2. The issue is due to improper neutralization of input in the 'page' parameter, which allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires tricking a user into clicking a malicious link, leading to script execution in the context of the affected site. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity with no impact on availability.

An attacker can perform reflected XSS attacks by injecting malicious scripts via the 'page' parameter, potentially leading to information disclosure or manipulation of user interactions on the affected site. The vulnerability requires user interaction (clicking a crafted link) and affects confidentiality and integrity to a limited extent. There is no known impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links related to the affected plugin and consider disabling or removing the plugin if feasible. Monitor official channels for updates from the vendor regarding patches or mitigations.