CVE-2024-12493 is a stored cross-site scripting vulnerability in the Files Download Delay WordPress plugin by blueberryacc, affecting all versions up to 1.0.9. The issue arises from insufficient sanitization and escaping of user-supplied attributes in the 'fddwrap' shortcode, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts. These scripts execute in the context of any user viewing the injected page, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. There is no vendor advisory or patch information available at this time.

An authenticated attacker with contributor-level or higher privileges can inject malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of users. The vulnerability does not affect availability and requires authenticated access, but it can compromise confidentiality and integrity of user sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Files Download Delay plugin if possible to prevent exploitation.