The BerqWP plugin for WordPress, which optimizes page speed and core web vitals, contains a reflected XSS vulnerability identified as CVE-2024-9344. This vulnerability is due to improper neutralization of input in the 'url' parameter, allowing injection of malicious scripts. It affects all versions up to and including 2.1.1. The vulnerability enables unauthenticated attackers to craft URLs that, when clicked by users, execute arbitrary JavaScript in the context of the affected site. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity. No patch or vendor advisory is currently provided, and the plugin is not a cloud service.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user data, hijack user sessions, or perform actions on behalf of the user. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires user interaction and no authentication is needed to initiate the attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid clicking suspicious links that include the 'url' parameter targeting the BerqWP plugin. Monitoring for updates from the plugin vendor is recommended to apply any official fixes once released.