CVE-2024-12076 is a CSRF vulnerability in the Target Video Easy Publish WordPress plugin (up to version 3.8.3) caused by missing or incorrect nonce validation on the resync_carousel(), seek_snapshot(), uploaded_cc(), and remove_cc() functions. This allows unauthenticated attackers to perform actions on behalf of an administrator if the administrator is tricked into clicking a malicious link, potentially leading to Cross-Site Scripting (CWE-79) attacks. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity.

Successful exploitation can lead to injection of malicious web scripts via forged requests executed by an authenticated administrator, potentially compromising confidentiality and integrity of the affected site. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisory for updates and consider implementing manual nonce validation or disabling the affected plugin functions until a fix is released. Avoid clicking suspicious links and limit administrator exposure to untrusted content.