CVE-2024-12449 is a stored cross-site scripting vulnerability in the Video Share VOD – Turnkey Video Site Builder Script WordPress plugin, affecting all versions up to 2.6.30. The vulnerability exists due to improper neutralization of input in the 'videowhisper_player_html' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that execute in the context of users viewing the injected pages. This can lead to partial confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N).

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages generated by the plugin. When other users access these pages, the injected scripts execute in their browsers, potentially leading to theft of sensitive information or manipulation of page content. The CVSS score of 6.4 reflects a medium severity with low confidentiality and integrity impacts and no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable shortcode if feasible. Monitor official videowhisper channels for updates and apply any forthcoming patches promptly.