CVE-2024-8715 is a reflected Cross-Site Scripting vulnerability in the Simple LDAP Login WordPress plugin by clifgriffin. The issue arises from the use of add_query_arg without proper escaping of URL parameters, enabling injection of malicious scripts. This affects all versions up to and including 1.6.0. An attacker can exploit this by tricking a user into clicking a malicious link, causing script execution in the user's browser context. The vulnerability has a CVSS 3.1 base score of 6.1 with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity, with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links related to the affected plugin and consider disabling or replacing the plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.