CVE-2024-13827 is a reflected cross-site scripting vulnerability in the Razorpay Subscription Button Elementor Plugin for WordPress. The issue stems from the plugin's use of add_query_arg() and remove_query_arg() functions without proper escaping of URL parameters, allowing injection of arbitrary web scripts. This affects all versions up to and including 1.0.3. The vulnerability requires user interaction (clicking a malicious link) and can lead to script execution in the context of the affected site, potentially compromising user data or session integrity. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and impact on confidentiality and integrity but not availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website for users who click on a crafted link. This can lead to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality and integrity of user data. Availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious links related to the affected plugin and consider disabling or replacing the plugin if feasible. Monitor the vendor's official channels for updates or patches addressing this vulnerability.