CVE-2024-9615 is a reflected cross-site scripting vulnerability in the BulkPress WordPress plugin (versions up to 0.3.5). The issue arises from the use of add_query_arg without proper escaping of URL parameters, enabling unauthenticated attackers to inject malicious scripts. Successful exploitation requires user interaction, such as clicking a malicious link, which then executes the injected script in the context of the affected site.

An attacker can perform reflected XSS attacks, potentially leading to limited confidentiality and integrity impacts by executing arbitrary scripts in the victim's browser. This could result in actions such as session hijacking or content manipulation. The CVSS vector indicates no privileges required and low attack complexity, but user interaction is necessary. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the BulkPress plugin or restricting access to affected functionality. Additionally, applying web application firewall (WAF) rules to detect and block reflected XSS attempts may help mitigate risk.