CVE-2024-12495 is a stored cross-site scripting vulnerability in the Bootstrap Blocks for WP Editor v2 WordPress plugin, affecting all versions up to 2.5.0. The issue is due to improper neutralization of input during web page generation in the 'gtb-bootstrap/column' block, allowing authenticated users with Contributor-level permissions or higher to inject arbitrary scripts. These scripts execute when any user accesses the compromised page, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required (low), no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix has been documented in the provided data.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable block. These scripts execute in the context of users viewing the page, potentially exposing sensitive information or enabling further attacks such as session hijacking. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the vulnerable 'gtb-bootstrap/column' block if possible. Monitor for updates from the plugin vendor regarding patches or official mitigations.