CVE-2024-12611 is a reflected cross-site scripting vulnerability in the School Management System for WordPress plugin (versions up to 93.0.0) caused by missing authorization checks and inadequate input sanitization on the 'title' parameter. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if they are tricked into clicking a crafted link. The vulnerability is identified as CWE-862, indicating missing authorization, and has a CVSS 3.1 base score of 5.3 (medium severity). No known exploits in the wild or patch availability have been reported.

The vulnerability allows an unauthenticated attacker to perform reflected cross-site scripting attacks by injecting malicious scripts via the 'title' parameter. This can lead to limited impact such as script execution in the victim's browser, potentially enabling actions like session hijacking or phishing. However, the CVSS vector indicates no confidentiality or availability impact, only integrity impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted links that may exploit this vulnerability. Monitoring vendor channels for updates and applying any forthcoming patches promptly is recommended.