CVE-2024-2200 is a reflected Cross-Site Scripting vulnerability in the Contact Form by BestWebSoft WordPress plugin, affecting all versions up to 4.2.8. The vulnerability exists due to improper neutralization of input in the 'cntctfrm_contact_subject' parameter, which allows injection of malicious scripts that execute in the context of a victim's browser when they are tricked into clicking a crafted link or performing a similar action. The vulnerability requires no privileges but does require user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or manipulation of user interactions within the affected site. The vulnerability does not impact system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the vulnerable parameter or plugin. Monitor official BestWebSoft communications for updates and apply any released patches promptly.