CVE-2024-5638 is a reflected cross-site scripting vulnerability in the Formula theme for WordPress, affecting all versions up to 0.5.1. The issue arises from insufficient input sanitization and output escaping of the ‘id’ parameter in the 'ti_customizer_notify_dismiss_recommended_plugins' AJAX action. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript in the context of the affected site. This vulnerability requires user interaction (clicking a link) and does not require authentication.

Successful exploitation can lead to the execution of arbitrary scripts in the victim's browser, potentially allowing theft of user credentials, session tokens, or other sensitive information accessible via the browser. The vulnerability does not impact availability but can compromise confidentiality and integrity of user data within the affected site context. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or restricting access to the affected AJAX action if possible. Additionally, educating users to avoid clicking suspicious links related to the affected site can reduce risk.