CVE-2024-37471 is a reflected Cross Site Scripting (XSS) vulnerability in WofficeIO Woffice Core, affecting versions through 5.4.8. The vulnerability allows attackers to inject malicious scripts that execute in the context of a victim's browser, potentially leading to information disclosure, session hijacking, or other impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or official remediation is currently available.

Successful exploitation of this reflected XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. Attackers may execute arbitrary scripts in users' browsers, potentially stealing session tokens or performing unauthorized actions within the application context. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and educate users to avoid clicking suspicious links. Monitor vendor channels for updates and apply patches promptly once available.