CVE-2024-11326: 
WordPress vulnerability analysis and mitigation

The Campaign Monitor Forms by Optin Cat WordPress plugin contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-11326) affecting all versions up to and including 2.5.7. The vulnerability was disclosed on December 3, 2024, and stems from improper URL escaping in the add_query_arg function (NVD).

The vulnerability arises from insufficient escaping of URL parameters when using the add_query_arg function in the plugin. This implementation flaw has been assigned a CVSS v3.1 base score of 6.1 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The potential impact includes the compromise of user data and possible session hijacking (NVD).

Website administrators running the Campaign Monitor Forms by Optin Cat plugin should update to a version newer than 2.5.7 as soon as possible to address this vulnerability (NVD).