CVE-2024-12049 is a reflected cross-site scripting vulnerability in the Woo Ukrposhta plugin for WordPress. It affects all versions up to and including 1.17.11 due to improper neutralization of input during web page generation (CWE-79). The vulnerability is exploitable via the 'order', 'post', and 'idd' parameters, which do not properly sanitize or escape user input. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user interacts with a maliciously crafted link.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session. This may result in theft of user credentials, session hijacking, or other actions performed with the user's privileges. The CVSS 3.1 base score of 6.1 reflects a medium impact with low complexity and no required privileges, but user interaction is necessary. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links involving the affected parameters. Monitoring for updates from the plugin vendor or WordPress security channels is recommended to apply any forthcoming patches promptly.