CVE-2024-11814 is a reflected cross-site scripting vulnerability in the Additional Custom Order Status for WooCommerce plugin for WordPress, affecting all versions up to and including 1.6.0. The issue arises from insufficient input sanitization and output escaping of the wfwp_wcos_delete_finished, wfwp_wcos_delete_fallback_finished, wfwp_wcos_delete_fallback_orders_updated, and wfwp_wcos_delete_fallback_status parameters. An unauthenticated attacker can exploit this by crafting malicious URLs that, when clicked by a user, execute arbitrary web scripts within the context of the affected site.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session on the affected WordPress site. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not require authentication and has a medium severity rating (CVSS 6.1). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted links involving the affected plugin parameters. Monitoring vendor channels for updates and applying patches promptly once available is recommended.