CVE-2024-12207 is a stored cross-site scripting vulnerability (CWE-79) in the Toggles Shortcode and Widget plugin for WordPress by otwthemes. It affects all versions up to 1.14 and occurs due to improper neutralization of input in the 'content' parameter. Authenticated users with administrator privileges can inject malicious scripts that execute in the context of users visiting the injected pages. This vulnerability specifically impacts multi-site WordPress installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring administrator privileges without user interaction.

An authenticated attacker with administrator-level access on affected WordPress multi-site installations or where unfiltered_html is disabled can inject persistent malicious scripts. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to information disclosure or session hijacking. The impact is limited by the requirement for administrator privileges and specific WordPress configurations.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the Toggles Shortcode and Widget plugin in multi-site environments or where unfiltered_html is disabled to prevent exploitation.