CVE-2024-9385 describes a reflected Cross-Site Scripting vulnerability in the Themify Builder WordPress plugin. The issue arises from the use of add_query_arg without proper escaping of URL parameters, enabling injection of malicious scripts. This affects all versions up to and including 7.6.2. An attacker can exploit this by tricking a user into clicking a specially crafted link, causing script execution in the user's browser context. The vulnerability has a CVSS 3.1 base score of 6.1, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session tokens, and manipulation of web page content. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links related to Themify Builder content and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts targeting this plugin.