CVE-2024-11811 is a reflected cross-site scripting vulnerability in the Feedify – Web Push Notifications plugin for WordPress, affecting all versions up to and including 2.4.2. The flaw arises from improper neutralization of input during web page generation, specifically in the 'platform', 'phone', 'email', and 'store_url' parameters. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user interacts with a maliciously crafted link. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity without availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session, potentially allowing theft of sensitive information or session tokens. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and does not require authentication. There are no known active exploits in the wild at this time.

No official patch or fix has been documented as of the published date. Users should monitor the vendor's advisory channels for updates. Until a fix is available, users should consider disabling or removing the Feedify – Web Push Notifications plugin if feasible. Additionally, applying web application firewall (WAF) rules to detect and block suspicious input in the affected parameters may provide temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.