CVE-2024-12519 is a stored cross-site scripting vulnerability in the TCBD Auto Refresher WordPress plugin (versions up to and including 2.0). The issue stems from improper neutralization of input during web page generation, specifically in the 'tcbd_auto_refresh' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated users with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript that executes in the context of any user viewing the affected page. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium impact on confidentiality and integrity without affecting availability.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the page, potentially compromising user data confidentiality and integrity. There is no direct impact on system availability. No known exploits have been reported in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the TCBD Auto Refresher plugin if feasible to prevent exploitation.