CVE-2024-12523 is a stored cross-site scripting vulnerability in the States Map US WordPress plugin by wssoffice21. The issue exists in all versions up to and including 2.4.2 within the 'states_map' shortcode, where user input is not properly sanitized or escaped before being rendered. Authenticated users with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of any user viewing the compromised page. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. No known exploits are reported in the wild, and no patch or remediation details have been provided.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the page, potentially exposing sensitive information or altering page content. The impact is limited to confidentiality and integrity, with no direct availability impact. The vulnerability requires authenticated access, reducing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the States Map US plugin if possible. Monitor for updates from the vendor or plugin maintainers to apply any forthcoming patches promptly.