The RabbitLoader – AI Speed Optimization, Caching & CDN plugin for WordPress and WooCommerce is vulnerable to reflected Cross-Site Scripting due to the use of add_query_arg without proper escaping on URL parameters. This vulnerability affects all versions up to 2.21.0. An unauthenticated attacker can craft a URL that injects malicious scripts, which execute when a user clicks the link. The vulnerability is tracked as CVE-2024-8800 with a CVSS 3.1 base score of 6.1 (medium severity). No patch or vendor advisory detailing remediation is currently provided.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a maliciously crafted link. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links received from untrusted sources and consider disabling or removing the vulnerable plugin version. Monitor the vendor's communications for updates on patches or official mitigations.