CVE-2024-12468 is a reflected cross-site scripting vulnerability in the WP Datepicker plugin for WordPress, affecting all versions up to and including 2.1.4. The issue stems from improper neutralization of input in the 'wpdp_get_selected_datepicker' parameter, enabling attackers to inject arbitrary web scripts. Exploitation requires user interaction, such as clicking a malicious link, and can lead to limited confidentiality and integrity impacts. The vulnerability is unauthenticated and remotely exploitable over the network.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected site, potentially allowing attackers to steal user session data, perform actions on behalf of users, or manipulate site content. The CVSS vector indicates low complexity, no privileges required, user interaction needed, and impacts confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to vulnerable functionality. Avoid clicking on suspicious links that could trigger the vulnerability. Monitor vendor channels for updates and apply patches promptly once released.