CVE-2024-12591 is a stored cross-site scripting vulnerability in the MagicPost WordPress plugin (versions up to 1.2.1). The issue arises from improper neutralization of user-supplied attributes in the wb_share_social shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript. This script executes in the context of any user who views the infected page, potentially leading to session hijacking or other script-based attacks. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity).

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to information disclosure or user session compromise. The vulnerability does not affect availability and requires authenticated access with low attack complexity.

No official patch or remediation has been published by the vendor as of the current information. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the MagicPost plugin if feasible to prevent exploitation.