CVE-2024-8728 is a reflected cross-site scripting vulnerability in the Easy Load More WordPress plugin by brianbrey, affecting all versions up to and including 1.0.3. The issue arises from improper neutralization of input during web page generation, specifically due to the use of add_query_arg without appropriate escaping of URL parameters. This flaw allows unauthenticated attackers to inject arbitrary web scripts that execute when a user interacts with a crafted link. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting a medium severity with potential limited confidentiality and integrity impact but no availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session, potentially allowing theft of sensitive information or session tokens, and limited modification of displayed content. The vulnerability requires user interaction (clicking a malicious link) and does not grant attacker direct system access or denial of service. There are no reports of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links and consider disabling or replacing the Easy Load More plugin if possible. Monitoring vendor channels for updates is recommended.