CVE-2024-12024 is a stored cross-site scripting vulnerability in the EventPrime – Events Calendar, Bookings and Tickets WordPress plugin. It affects all versions up to and including 4.0.7.3. The vulnerability is due to improper neutralization of input during web page generation, specifically in the em_ticket_category_data and em_ticket_individual_data parameters. An unauthenticated attacker can exploit this by injecting arbitrary web scripts, which execute in the context of administrative users when they access the injected pages. The attack surface is limited by the requirement that the 'Guest Submissions' setting must be enabled, which is off by default.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the browser of an administrative user, potentially leading to session hijacking, privilege escalation, or other malicious actions within the admin context. The vulnerability does not impact availability but compromises confidentiality and integrity of administrative sessions and data. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, no privileges required, no user interaction, and impact on confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure the 'Guest Submissions' setting remains disabled (default state) to prevent exploitation. Administrators should be cautious when enabling this feature and monitor for updates from the vendor metagauss regarding patches or mitigations.