CVE-2024-8740 describes a reflected Cross-Site Scripting vulnerability in the GetResponse Forms by Optin Cat WordPress plugin. The issue arises from the use of add_query_arg without proper escaping of URL parameters, enabling injection of malicious scripts. This affects all versions up to and including 2.5.7. The vulnerability requires user interaction (clicking a crafted link) and does not require privileges or authentication. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impact, and no availability impact.

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of the affected site by tricking users into clicking malicious links. This can lead to theft of user credentials, session hijacking, or other client-side attacks affecting confidentiality and integrity. There is no direct impact on availability. The vulnerability affects all users of the plugin up to version 2.5.7.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links related to the affected plugin and consider disabling or removing the plugin if possible. Monitor the vendor's channels for updates or patches addressing this vulnerability.