CVE-2024-28001 describes a reflected cross-site scripting (XSS) vulnerability in the Archetyped Favicon Rotator plugin (up to version 1.2.10). The issue is due to improper neutralization of input during web page generation, classified under CWE-79. This vulnerability allows attackers to inject malicious scripts that execute in the victim's browser when they interact with crafted URLs or inputs. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 7.1 reflects these risks. However, no known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts and avoid exposing vulnerable endpoints to untrusted input. Monitor the Archetyped vendor channels for updates and apply patches promptly once released.