CVE-2024-9667 is a reflected cross-site scripting vulnerability in the Seriously Simple Podcasting WordPress plugin (podcastmotor) affecting all versions up to 3.5.0. The issue stems from the use of the add_query_arg function without proper escaping of URL parameters, enabling injection of malicious scripts by unauthenticated attackers. Successful exploitation requires user interaction, such as clicking a malicious link, which causes the injected script to execute in the context of the affected site. The vulnerability is identified as CWE-79 and has a CVSS v3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

An attacker can inject and execute arbitrary web scripts in the context of the vulnerable site by tricking users into clicking crafted links. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no direct impact on availability. The vulnerability requires no privileges but does require user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links and consider disabling or limiting use of the Seriously Simple Podcasting plugin if possible. Monitor official vendor channels for updates and apply patches promptly once available.