CVE-2024-8718 is a reflected cross-site scripting vulnerability in the Gravity Forms Toolbar WordPress plugin by daveshine. The issue is due to improper neutralization of input in the 'tab' parameter, which allows injection of malicious scripts when a user clicks a crafted link. This affects all plugin versions up to and including 1.7.0. The vulnerability requires no privileges and low attack complexity but requires user interaction. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low complexity, no privileges, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a malicious link. This can lead to partial confidentiality and integrity impacts such as theft of session tokens or manipulation of displayed content. There is no impact on system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links that may exploit this vulnerability. Monitor the vendor's communications for updates or patches addressing this issue.