CVE-2024-9374 is a reflected cross-site scripting vulnerability in the Terms descriptions WordPress plugin by vladimirs. The issue is due to the use of add_query_arg without proper escaping of URL parameters, which allows injection of malicious scripts. This affects all plugin versions up to 3.4.6. An attacker can exploit this by convincing a user to click a malicious link, causing script execution in the context of the affected site. The vulnerability is unauthenticated and has a CVSS 3.1 score of 6.1 (medium severity). No patch or remediation has been documented or linked by the vendor.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially resulting in information disclosure or user session manipulation. The impact is limited to confidentiality and integrity with no direct availability impact. Since the vulnerability is reflected XSS, it requires user interaction (clicking a crafted link) to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or applying manual code review and sanitization of inputs if feasible. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor the vendor's channels for updates or patches addressing this vulnerability.