This vulnerability (CVE-2024-29790) in the Squirrly SEO Plugin involves improper neutralization of input during web page generation, classified under CWE-79 (Cross-site Scripting). It allows reflected XSS attacks, where malicious scripts can be injected and executed in the context of a user's browser session. The affected versions include all releases up to 12.3.16. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction, and it impacts confidentiality, integrity, and availability to a limited extent. No vendor-provided patch or official remediation is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions affecting confidentiality, integrity, and availability of user data. The reflected nature of the XSS requires user interaction to trigger the attack. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts. Monitor vendor channels for updates and apply patches promptly once available.