CVE-2024-9357 is a reflected cross-site scripting vulnerability in the xili-tidy-tags plugin for WordPress, affecting all versions up to and including 1.12.04. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'action' parameter. An unauthenticated attacker can exploit this by tricking a user into clicking a crafted link, causing arbitrary script execution in the user's browser context. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity) with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser when they interact with a maliciously crafted link. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or manipulation of page content. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links and consider disabling or removing the xili-tidy-tags plugin if feasible. Monitor official sources for updates regarding patches or mitigations.