CVE-2024-12221 is a reflected cross-site scripting vulnerability in the Turnkey bbPress by WeaverTheme WordPress plugin affecting all versions up to 1.6.3. The issue stems from improper neutralization of input in the '_wpnonce' parameter, enabling unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they click on a crafted link. The vulnerability is identified as CWE-79 and has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No known exploits in the wild have been reported, and no patch or remediation details are currently available.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to information disclosure or manipulation of user interactions. The impact is limited to confidentiality and integrity with no direct availability impact. This can facilitate phishing or session hijacking attacks if users are tricked into clicking malicious links.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links and consider disabling or restricting use of the affected plugin. Monitor vendor channels for updates and apply patches promptly once released.