The WPML Multilingual & Multicurrency for WooCommerce plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) due to the use of the add_query_arg function without proper escaping of URL parameters. This flaw affects all versions up to 5.3.7 and allows unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a maliciously crafted link. The vulnerability is publicly known as CVE-2024-8629 and has a CVSS 3.1 base score of 6.1, indicating medium severity. No patch or official vendor advisory is currently available, and no exploits have been observed in the wild.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a crafted link. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of web page content. There is no impact on availability. The vulnerability requires user interaction and no privileges are needed to exploit it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution with links received from untrusted sources and consider disabling or restricting the use of the affected plugin. Monitor official channels for updates or patches from the plugin vendor.