CVE-2024-32559 is a reflected Cross-site Scripting (XSS) vulnerability classified under CWE-79 in the hwk-fr WP 404 Auto Redirect to Similar Post WordPress plugin. The issue stems from improper input neutralization during web page generation, enabling attackers to inject malicious scripts that execute in users' browsers. This vulnerability affects all versions up to 1.0.4. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or official remediation is currently available, and no exploits have been reported in the wild.

Successful exploitation of this vulnerability allows an attacker to perform reflected XSS attacks, potentially leading to unauthorized script execution in the context of the affected website. This can result in partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, no known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin if feasible. Additionally, applying web application firewall (WAF) rules that detect and block reflected XSS payloads may provide temporary mitigation.