CVE-2024-12505 is a stored cross-site scripting vulnerability in the Trackserver plugin for WordPress, present in all versions up to and including 5.0.2. The issue stems from improper neutralization of input in the 'tsmap' shortcode, where user-supplied attributes are not adequately sanitized or escaped. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users visiting the infected pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4, reflecting a medium impact on confidentiality and integrity without affecting availability.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the 'tsmap' shortcode. These scripts execute in the browsers of users who view the compromised pages, potentially leading to unauthorized actions or data exposure limited to the scope of the injected script. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or update has been provided by the vendor as of the published date. Users should monitor the vendor's advisory channels for updates. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or removing the Trackserver plugin if feasible to prevent exploitation.