CVE-2024-12499 is a stored cross-site scripting vulnerability in the WP jQuery DataTable WordPress plugin, affecting versions up to 4.0.1. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes in the 'wp_jdt' shortcode. This allows authenticated users with contributor-level privileges or higher to inject malicious scripts that execute when the page is viewed, potentially impacting confidentiality and integrity. The CVSS 3.1 base score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the low level, no user interaction, and a scope change. No vendor patch or official fix details are currently available.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages via the shortcode, which execute in the context of users viewing those pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. There is no impact on availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the WP jQuery DataTable plugin if possible. Monitor for updates from the vendor regarding patches or official mitigations.