CVE-2024-11973 is a reflected cross-site scripting vulnerability in the Quran multilanguage Text & Audio WordPress plugin affecting all versions up to 2.3.21. The issue is due to improper neutralization of input in the 'sourate' and 'lang' parameters, allowing injection of arbitrary web scripts. This vulnerability can be triggered by unauthenticated attackers who trick users into clicking malicious links, leading to script execution in the context of the affected site. The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality and integrity but not availability. No patch or official remediation details are currently available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the vulnerable website when a user clicks a crafted link. This can lead to partial compromise of confidentiality and integrity of user data or session information. Availability is not impacted. The vulnerability does not require authentication but does require user interaction. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking untrusted links that include the 'sourate' and 'lang' parameters targeting the affected plugin. Monitoring vendor channels for updates is recommended. No official patch or temporary fix information is currently available.