CVE-2024-9647 is a reflected Cross-Site Scripting vulnerability in the tkama Kama SpamBlock WordPress plugin affecting all versions up to and including 1.8.2. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of $_POST values. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of a victim's browser when they perform an action such as clicking a malicious link. The CVSS 3.1 vector indicates the attack requires no privileges, has low attack complexity, requires user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session tokens, and manipulation of web content. The vulnerability affects confidentiality and integrity but does not impact availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Kama SpamBlock plugin or applying manual input sanitization and output escaping if feasible. Additionally, users should exercise caution with unsolicited links and user interactions that could trigger the vulnerability.