CVE-2024-12160 is a reflected cross-site scripting vulnerability in the Seraphinite Bulk Discounts for WooCommerce plugin for WordPress. The vulnerability results from the use of add_query_arg without proper escaping of URL parameters, enabling injection of arbitrary web scripts. This affects all versions up to and including 2.4.6. An unauthenticated attacker can exploit this by crafting a malicious URL that, when clicked by a user, executes injected scripts in the context of the affected site. The CVSS 3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impact on confidentiality and integrity but not availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session on the affected site. This can lead to disclosure of sensitive information or manipulation of site content as perceived by the user. There is no reported impact on system availability. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links received from untrusted sources. Monitoring the vendor's site or plugin repository for updates is recommended to apply any forthcoming patches promptly.