CVE-2024-12299 is a reflected cross-site scripting vulnerability in the qriouslad System Dashboard WordPress plugin. It affects all versions up to 2.8.17 due to improper neutralization of input in the Filename parameter. The vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrative user interacts with a crafted link. The CVSS 3.1 base score is 6.1 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability. No patch or official fix details are provided, and the plugin is not a cloud service.

Exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of an administrative user's browser session. This may allow attackers to perform actions with the privileges of the admin user, potentially leading to information disclosure or manipulation of the affected WordPress site. However, the impact is limited by the requirement for user interaction and the reflected nature of the XSS. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links involving the System Dashboard plugin and consider disabling or restricting access to the plugin if possible. Monitoring for updates from the vendor or plugin author is recommended to apply any forthcoming patches promptly.