CVE-2024-12749

CVE-2024-12749 is a reflected cross-site scripting (XSS) vulnerability in the Competition Form WordPress plugin through version 2.0. The plugin fails to sanitize and escape a parameter before outputting it back in the page, allowing malicious scripts to be injected and executed in a user's browser. This issue is classified under CWE-79 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and potential scope change.

An attacker can exploit this vulnerability remotely without authentication by crafting a malicious URL containing the unsanitized parameter and tricking a targeted user, such as a high-privilege administrator, into interacting with it, typically via a phishing link or social engineering. Successful exploitation executes arbitrary JavaScript in the victim's browser context, potentially enabling session hijacking, data theft, or further actions limited by the low confidentiality, integrity, and availability impacts outlined in the CVSS score.

Advisories are available from WPScan at https://wpscan.com/vulnerability/478316b9-9f47-4aa6-92c6-03879f16a3e5/, which documents the vulnerability details but does not specify patch availability in the provided information. Security practitioners should update the plugin beyond version 2.0 where possible and implement content security policies to mitigate XSS risks.