CVE-2024-8724 describes a reflected Cross-Site Scripting vulnerability in the Waitlist Woocommerce (Back in stock notifier) WordPress plugin, present in all versions up to and including 2.7.5. The issue arises from the use of the add_query_arg function without proper escaping of URL parameters, enabling attackers to inject malicious scripts into web pages. Exploitation requires user interaction, such as clicking a malicious link, and can lead to partial compromise of confidentiality and integrity of user data within the affected web context.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal sensitive information or perform actions on behalf of the user. The vulnerability does not impact availability. The CVSS 3.1 base score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and scope change. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links related to the plugin and consider disabling or removing the plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.