The vulnerability identified as CVE-2024-9237 affects the wpcentrics plugin 'Advanced Shipping Rates for WooCommerce: Flexible Table Rate Shipping Rules' for WordPress. It is a reflected cross-site scripting (CWE-79) flaw caused by the use of the add_query_arg function without proper escaping of URL parameters. This flaw exists in all versions up to and including 1.5.9. An attacker can exploit this by crafting a malicious URL that, when clicked by a user, executes arbitrary JavaScript in the context of the affected site. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website, potentially leading to partial disclosure of confidential information and modification of data integrity. There is no impact on system availability. The vulnerability requires user interaction (clicking a crafted link) and affects the confidentiality and integrity of the web application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links and consider disabling or limiting use of the affected plugin. Monitor vendor channels for updates and apply patches promptly when available.