CVE-2024-12290 is a reflected cross-site scripting vulnerability in the Infility Global WordPress plugin affecting all versions up to 2.9.8. The issue is due to improper neutralization of input in the 'set_type' parameter, which allows unauthenticated attackers to inject malicious scripts into web pages. Successful exploitation requires user interaction, such as clicking a malicious link, leading to script execution in the victim's browser. This vulnerability is tracked under CWE-79 and has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity.

An attacker can exploit this vulnerability to execute arbitrary scripts in the context of the affected website, potentially leading to theft of user credentials, session hijacking, or other malicious actions affecting confidentiality and integrity. The attack requires user interaction and does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently referenced, users should monitor vendor communications for updates. Until a fix is available, consider applying temporary mitigations such as disabling the vulnerable plugin or restricting access to affected parameters if feasible.