CVE-2024-12162 is a reflected cross-site scripting vulnerability in the Video & Photo Gallery for Ultimate Member WordPress plugin. The flaw exists due to improper neutralization of input in the 'page' parameter, enabling injection of arbitrary web scripts. This affects all versions up to and including 1.1.1. The vulnerability allows unauthenticated attackers to craft malicious links that, when clicked by users, execute injected scripts in the context of the vulnerable site. The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user session data, perform actions on behalf of users, or deface web content. The impact affects confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin or applying web application firewall (WAF) rules to block malicious input targeting the 'page' parameter. Avoid clicking on suspicious links related to the affected site. Monitor vendor communications for updates regarding patches or official mitigations.