CVE-2024-12324 is a reflected cross-site scripting vulnerability in the Unilevel MLM Plan WordPress plugin, affecting all versions up to 1.1.0. The issue is due to improper neutralization of input in the 'page' parameter, which allows unauthenticated attackers to inject and execute arbitrary web scripts by tricking users into clicking malicious links. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser session, potentially allowing theft of sensitive information or session hijacking. However, exploitation requires user interaction (clicking a malicious link) and does not affect system availability. The vulnerability impacts confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking links related to the affected plugin and consider disabling or removing the plugin if possible. Monitoring for updates from the vendor or WordPress plugin repository is recommended to apply any forthcoming patches.