CVE-2024-8792: 
WordPress vulnerability analysis and mitigation

The Subscribe to Comments plugin for WordPress (CVE-2024-8792) contains a Reflected Cross-Site Scripting vulnerability affecting all versions up to and including 2.3. The vulnerability was discovered and disclosed on October 29, 2024, and is tracked with a CVSS v3.1 base score of 6.1 (Medium) (NVD).

The vulnerability stems from improper use of the add_query_arg function without appropriate URL escaping in the WordPress Subscribe to Comments plugin. This implementation flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform certain actions, such as clicking on a malicious link. The CVSS metrics indicate moderate potential for both confidentiality and integrity impacts, with no effect on availability (NVD).

The vulnerability requires user interaction for successful exploitation, as indicated by the CVSS metrics (UI:R). An unauthenticated attacker can exploit this vulnerability by crafting malicious links that, when clicked by users, execute arbitrary web scripts (NVD).