The Pixel Cat – Conversion Pixel Manager plugin for WordPress suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping on URL parameters. This flaw exists in all versions up to 3.0.5 and enables unauthenticated attackers to inject and execute arbitrary web scripts by tricking users into clicking malicious links. The vulnerability is tracked as CVE-2024-8544 and is classified under CWE-79. It has a CVSS 3.1 base score of 6.1, indicating a medium severity level. No patch or official fix information is currently available, and the plugin is not a cloud service.

Successful exploitation allows an unauthenticated attacker to perform reflected cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the victim's browser. This can result in limited confidentiality and integrity impacts, such as theft of user session data or manipulation of web content. There is no impact on availability reported. No known active exploits have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links related to the Pixel Cat plugin and consider disabling or removing the plugin if feasible. Monitoring for vendor updates and applying any future patches promptly is recommended.