CVE-2024-12574 is a stored cross-site scripting vulnerability in the amrendesign SVG Shortcode WordPress plugin (versions up to 1.0.1). The issue arises from insufficient input sanitization and output escaping of uploaded SVG files, enabling unauthenticated attackers to embed arbitrary scripts. These scripts execute in the context of users who view the affected SVG content, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, and user interaction needed.

Exploitation of this vulnerability can lead to the execution of arbitrary scripts in the browsers of users who access the malicious SVG files. This may result in limited disclosure of information or modification of content within the affected web application context. There is no indication of availability impact or widespread exploitation in the wild at this time.

No official patch or fix has been confirmed or provided by the vendor as of the published date. Users should monitor the vendor's advisory channels for updates. Until a fix is available, consider disabling SVG file uploads or restricting upload permissions to trusted users only to reduce exposure. Validate and sanitize SVG content externally before upload if possible.