CVE-2024-9653 is a reflected cross-site scripting vulnerability in the gloriafood Restaurant Menu – Food Ordering System – Table Reservation WordPress plugin. The issue exists in all versions up to and including 2.4.2 due to improper neutralization of input in the 'action' parameter, allowing injection of malicious scripts. This can lead to script execution in the context of the victim's browser if they are tricked into clicking a crafted link. The vulnerability has a CVSS 3.1 score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser session, potentially leading to theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the 'action' parameter in affected plugin versions. Monitoring vendor channels for updates is recommended.