CVE-2024-9209 is a reflected cross-site scripting vulnerability in the WP Search Analytics plugin for WordPress, affecting all versions up to and including 1.4.10. The issue arises from improper neutralization of input during web page generation, specifically due to the use of add_query_arg without appropriate escaping on URL parameters. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user interacts with a maliciously crafted link. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no indication of known exploits in the wild or an official patch available at this time.

An attacker can exploit this vulnerability to perform reflected cross-site scripting attacks, potentially leading to limited confidentiality and integrity impacts by executing arbitrary scripts in the context of the victim's browser. This could allow theft of user session data or manipulation of the user interface. There is no impact on availability reported. Exploitation requires user interaction (clicking a crafted link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links related to the WP Search Analytics plugin and consider disabling or removing the plugin if feasible. Monitoring vendor channels for updates is recommended.