CVE-2024-12465 is a stored cross-site scripting vulnerability in the Property Hive Stamp Duty Calculator WordPress plugin (up to version 1.0.22). The issue occurs due to improper neutralization of input in the 'stamp_duty_calculator_scotland' shortcode, allowing authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code. This code executes in the context of any user who accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.4 (Network attack vector, Low attack complexity, Low privileges required, No user interaction, Scope changed, Low confidentiality and integrity impact, No availability impact). No patch or official fix information is currently available.

An authenticated attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The confidentiality and integrity of user data may be partially impacted, but availability is not affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Property Hive Stamp Duty Calculator plugin if feasible. Monitor for updates from the vendor and apply any official patches promptly once available.