CVE-2024-9354 is a reflected cross-site scripting vulnerability in the Estatik Mortgage Calculator WordPress plugin affecting all versions up to 2.0.11. The issue stems from improper neutralization of input in the 'color' parameter, which is not adequately sanitized or escaped before being included in web page output. This allows an unauthenticated attacker to craft malicious URLs that, when visited by a user, execute arbitrary JavaScript in the context of the affected site. The vulnerability has a CVSS 3.1 base score of 6.1, with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts confidentiality and integrity but not availability.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other actions performed with the user's privileges on the affected site. The impact affects confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Estatik Mortgage Calculator plugin or restricting access to it. Additionally, applying web application firewall (WAF) rules to detect and block malicious input targeting the 'color' parameter may help mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.