The vulnerability CVE-2024-47384 affects the WP Compress plugin by AresIT, specifically versions up to 6.20.13. It is a reflected Cross-site Scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a user interacts with crafted content, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction needed, and scope changed. No patch or official remediation guidance is currently available, and no exploits in the wild have been reported.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the victim's browser when they visit a crafted page or link. This can lead to partial disclosure of sensitive information, manipulation of web content, or disruption of service. The CVSS vector indicates limited confidentiality, integrity, and availability impacts. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected WP Compress plugin versions. Employing web application firewalls (WAFs) that can detect and block reflected XSS attempts may provide temporary mitigation. Monitor vendor channels for updates and apply official patches promptly once available.