CVE-2024-11688 is a reflected cross-site scripting vulnerability in the van-abel LaTeX2HTML WordPress plugin affecting all versions up to 2.5.5. The vulnerability is due to improper neutralization of input during web page generation, specifically in the handling of the 'ver' and 'date' parameters. Attackers can exploit this flaw by injecting malicious scripts that execute when a user interacts with a crafted URL. The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a malicious link. This can lead to information disclosure and integrity impacts such as session hijacking or unauthorized actions performed on behalf of the user. There is no indication of availability impact. The vulnerability does not require authentication and can be triggered remotely via crafted URLs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the LaTeX2HTML plugin if feasible. Additionally, applying web application firewall (WAF) rules to detect and block malicious input in the 'ver' and 'date' parameters may help mitigate exploitation. Avoid clicking on suspicious links that may contain crafted parameters targeting this vulnerability.