CVE-2024-9652 is a reflected cross-site scripting vulnerability in the Locatoraid Store Locator WordPress plugin (versions up to 3.9.47). It results from improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of $_POST parameters. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a victim interacts with a malicious link. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (medium severity). No patch or official fix has been disclosed yet, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to perform actions such as session hijacking, defacement, or redirecting users to malicious sites. The impact is limited to confidentiality and integrity with no direct availability impact. Since the vulnerability is reflected XSS, exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the Locatoraid Store Locator plugin or applying custom input sanitization and output escaping as a temporary mitigation. Monitor official vendor channels for updates and apply patches promptly once available.