CVE-2024-12042 is a CWE-434 vulnerability in the MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin. It arises from insufficient validation of uploaded file types in the profile picture upload functionality, allowing authenticated users with subscriber-level privileges or higher to upload HTML files containing malicious scripts. These scripts are stored and executed when the uploaded file is accessed, resulting in stored cross-site scripting. The vulnerability affects all versions up to and including 4.16.4. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with partial impact on confidentiality and integrity but no impact on availability. No known exploits in the wild or vendor patches are currently documented.

An authenticated attacker with subscriber-level access can upload malicious HTML files via the profile picture upload feature, leading to stored cross-site scripting. This can result in execution of arbitrary scripts in the context of users accessing the uploaded files, potentially compromising user data confidentiality and integrity. There is no direct impact on system availability. The vulnerability requires user interaction and privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict profile picture upload permissions to trusted users only and consider implementing additional file type validation or filtering at the web server or application firewall level to block HTML or script files. Monitor updates from the vendor for an official patch.