The Themify Builder plugin for WordPress suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping of URL parameters in all versions up to 7.6.5. This flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when the victim clicks a specially crafted link. The vulnerability is tracked as CVE-2024-13319 with a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). There are no patch links or vendor advisories provided, and no known active exploitation has been reported.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure or manipulation of user interactions on affected sites using the Themify Builder plugin. The impact is limited to confidentiality and integrity with no availability impact. The attack requires user interaction (clicking a malicious link) and can be performed by unauthenticated attackers over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links and consider applying temporary mitigations such as disabling or restricting the Themify Builder plugin if feasible. Monitor the vendor's official channels for updates regarding patches or official fixes.