This vulnerability (CVE-2024-35737) in Loopus WP Visitors Tracker is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected Cross-site Scripting (XSS) flaw. It affects versions up to 2.3 of the plugin. The vulnerability enables attackers to inject malicious scripts that execute in the context of a victim's browser when they visit a crafted URL or page. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation is currently available.

Successful exploitation of this reflected XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected web application and its users. Attackers may execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin if feasible. Employing web application firewalls (WAFs) that can detect and block reflected XSS attempts may provide temporary mitigation. Monitor vendor communications for updates on patches or official fixes.