CVE-2024-11723 is a reflected cross-site scripting vulnerability in the kvCORE IDX WordPress plugin (versions up to 2.3.35). It affects pages containing the kvcoreidx_listings_sitemap_ranges, kvcoreidx_listings_sitemap_page, kvcoreidx_agent_profile_sitemap, or kvcoreidx_agent_profile shortcodes. The root cause is insufficient sanitization and escaping of user-controllable input parameters, enabling unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser upon interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session when the victim interacts with a crafted link. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of displayed content. There is no impact on system availability. The vulnerability does not require authentication and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to affected shortcodes if possible. Additionally, avoid clicking on suspicious links that may trigger the vulnerability. Monitor vendor channels for updates or patches addressing this issue.