CVE-2024-12283 is a reflected cross-site scripting vulnerability in the WP Pipes plugin for WordPress, affecting all versions up to and including 1.4.1. The vulnerability is due to improper neutralization of input in the 'x1' parameter, allowing injection of arbitrary web scripts. An unauthenticated attacker can exploit this by convincing a user to click a malicious link, resulting in script execution within the victim's browser context. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing theft of user credentials, session tokens, or other sensitive information accessible to the browser. The vulnerability does not affect system availability and requires user interaction. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Pipes plugin or applying custom input sanitization and output escaping measures if feasible. Monitor official vendor channels for updates and patches.