CVE-2024-9208 is a reflected Cross-Site Scripting vulnerability in the Enable Accessibility plugin for WordPress. The issue arises from the use of add_query_arg and remove_query_arg functions without proper escaping of URL parameters, enabling injection of malicious scripts. This vulnerability affects all versions up to 1.4.1 and can be exploited by unauthenticated attackers who trick users into clicking malicious links, leading to script execution in the context of the affected site.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the vulnerable website, potentially allowing attackers to steal user session data, perform actions on behalf of users, or conduct phishing attacks. The vulnerability requires user interaction (clicking a crafted link) and does not require privileges or authentication. The CVSS vector indicates low attack complexity and no privileges required, with partial impact on confidentiality and integrity but no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links related to the Enable Accessibility plugin and consider disabling or removing the plugin if possible. Monitor vendor channels for updates and apply any official patches promptly once released.