CVE-2024-8734 describes a reflected Cross-Site Scripting vulnerability in the Lucas String Replace plugin for WordPress. The issue arises from the use of add_query_arg without proper escaping on URL parameters, enabling attackers to inject arbitrary web scripts. This vulnerability affects all plugin versions up to and including 2.0.5. Exploitation requires tricking a user into clicking a malicious link, leading to script execution in the context of the vulnerable site. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation can lead to the execution of attacker-controlled scripts in the context of the affected website, potentially allowing theft of user credentials, session tokens, or other sensitive information accessible via the browser. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links related to the affected site and consider disabling or replacing the Lucas String Replace plugin if possible. Monitor for updates from the plugin vendor for an official patch or mitigation instructions.