CVE-2024-12435 is a reflected cross-site scripting vulnerability (CWE-79) in the Compare Products for WooCommerce WordPress plugin affecting all versions up to 3.2.1. The issue stems from improper neutralization of input in the 's_feature' parameter, enabling unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they click a crafted link. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows an attacker to execute arbitrary web scripts in the victim's browser, potentially leading to theft of sensitive information or session hijacking. The vulnerability does not impact availability. The attack requires user interaction (clicking a malicious link) and can be performed by unauthenticated attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin or applying any recommended temporary mitigations from the vendor. Additionally, caution users against clicking suspicious links that may exploit this vulnerability.