The Bitcoin Lightning Publisher for WordPress plugin suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in URL parameters. Specifically, the plugin uses the add_query_arg function without proper escaping, enabling attackers to inject malicious scripts via crafted URLs. This vulnerability affects all plugin versions up to 1.4.1. An attacker can exploit this by convincing a user to click a malicious link, causing script execution in the context of the affected site. The vulnerability is tracked as CVE-2024-12100 with a CVSS 3.1 base score of 6.1 (medium severity). No patch or official remediation guidance has been provided by the vendor as of the published date.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a maliciously crafted link. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of displayed content. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links received from untrusted sources and consider disabling or removing the plugin if possible. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.