CVE-2024-9830 is a reflected cross-site scripting vulnerability in the Bard WordPress theme by wproyal. The issue arises from improper neutralization of input during web page generation, specifically due to the use of add_query_arg without appropriate escaping of URL parameters. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user interacts with a crafted link. The vulnerability affects all versions up to and including 2.216 and has a CVSS score of 6.1 (medium severity). No patch or official fix information is currently available.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to perform actions such as session hijacking, defacement, or redirection to malicious sites. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution with links received from untrusted sources. Consider applying temporary mitigations such as disabling or restricting the vulnerable theme or using web application firewalls that can detect and block reflected XSS attacks targeting this component.