CVE-2024-12239 is a reflected cross-site scripting vulnerability in the PowerPack Lite for Beaver Builder WordPress plugin, affecting all versions up to 1.3.0.5. The issue stems from improper neutralization of input in the 'navigate' parameter, which allows unauthenticated attackers to inject malicious scripts that execute when an administrative user interacts with a crafted link. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (medium severity). There is no indication of known exploits in the wild or available patches at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of an administrative user's browser session. This may allow attackers to perform actions with the privileges of the admin user, potentially leading to information disclosure or unauthorized actions within the affected WordPress site. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links containing the 'navigate' parameter in URLs related to the PowerPack Lite for Beaver Builder plugin. Monitoring vendor channels for updates is recommended.