CVE-2024-3681 is a reflected cross-site scripting vulnerability in the Interactive World Maps WordPress plugin by cmoreira. It affects all versions up to and including 2.4.14. The vulnerability arises from improper neutralization of input in the search (s) parameter, enabling attackers to inject malicious scripts that execute in the context of a victim's browser upon user interaction. The CVSS 3.1 base score is 6.1 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the vulnerable plugin or applying custom input sanitization and output escaping as a temporary mitigation. Monitor the vendor's communications for updates regarding patches or official fixes.