CVE-2024-12394 is a reflected cross-site scripting vulnerability in the Action Network plugin for WordPress, affecting all versions up to 1.4.4. The vulnerability exists due to improper neutralization of input in the 'page' parameter, enabling unauthenticated attackers to inject and execute arbitrary web scripts in the context of a victim's browser session. This can occur when a user is tricked into clicking a malicious link containing the crafted payload. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure and limited integrity impact. There is no reported impact on system availability. The vulnerability requires user interaction and does not require authentication. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links involving the 'page' parameter in the Action Network plugin. Consider applying web application firewall rules to detect and block suspicious input patterns targeting this parameter. Monitor for updates from the vendor or plugin maintainers regarding patches or official mitigations.