CVE-2024-4041 is a reflected cross-site scripting vulnerability in the Yoast SEO WordPress plugin (up to version 22.5). The issue arises from improper neutralization of input in URLs, allowing unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they interact with a crafted URL. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, reflecting medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. The vulnerability affects the Yoast SEO plugin, which is not a cloud service, and no official patch or vendor advisory with remediation instructions is currently available.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session tokens, or performing actions on behalf of the user. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction (clicking a malicious link) and no authentication is needed for the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when clicking on untrusted links that may target this vulnerability. Monitoring Yoast's official channels for updates and applying updates promptly once available is recommended.