CVE-2024-8741 describes a reflected Cross-Site Scripting vulnerability in the Beam me up Scotty – Back to Top Button plugin for WordPress, affecting all versions up to and including 1.0.21. The vulnerability stems from the plugin's use of the add_query_arg function without appropriate escaping of URL parameters, allowing unauthenticated attackers to inject malicious scripts. Successful exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser context. The CVSS 3.1 base score is 6.1 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

Exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user data, hijack user sessions, or perform actions on behalf of the user. The impact is limited to confidentiality and integrity, with no direct availability impact. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication.

No official patch or remediation has been published yet for this vulnerability. Patch status is not yet confirmed — check the vendor advisory or plugin update channels regularly for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting its use. Additionally, applying web application firewall (WAF) rules to detect and block reflected XSS attempts may help mitigate risk.