CVE-2024-12527 is a stored cross-site scripting vulnerability in the Perfect Portal Widgets WordPress plugin, specifically in the 'perfect_portal_intake_form' shortcode. Due to inadequate input sanitization and output escaping of user-supplied attributes, authenticated users with contributor or higher privileges can inject arbitrary JavaScript code. This code executes in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 3.0.3. There is no vendor advisory or patch information provided at this time.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure or session compromise. The vulnerability does not affect availability and requires authenticated access, limiting its scope. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Perfect Portal Widgets plugin if possible. Monitor official vendor channels for updates or patches addressing this vulnerability.