CVE-2024-12167 is a reflected cross-site scripting vulnerability in the Shortcodes Blocks Creator Ultimate WordPress plugin (versions up to 2.2.0). The issue stems from improper neutralization of input in the '_wpnonce' parameter, which is not adequately sanitized or escaped before being included in web page output. This allows unauthenticated attackers to craft malicious links that, when clicked by users, execute arbitrary JavaScript in the context of the affected site. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, indicating medium severity. No patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on plugin updates from the vendor.

Successful exploitation could lead to execution of arbitrary scripts in the context of the victim's browser, potentially enabling theft of user credentials, session tokens, or other sensitive information accessible via the browser. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication. There is no indication of impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Shortcodes Blocks Creator Ultimate plugin or applying custom input sanitization and output escaping as a temporary mitigation. Avoid clicking on suspicious links that could exploit this vulnerability.