CVE-2024-12325 identifies a reflected XSS vulnerability in the Waymark plugin for WordPress, affecting all versions up to 1.4.1. The issue arises from improper neutralization of input in the 'content' parameter, enabling attackers to inject malicious scripts that execute in the context of a victim's browser upon interaction. The vulnerability requires user interaction (clicking a link) and does not require privileges or authentication. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of user data, session hijacking, or other actions within the context of the affected website. The vulnerability does not impact system availability and requires user interaction. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links that might exploit this vulnerability. Monitoring vendor channels for updates or patches is recommended.