CVE-2024-12621 is a stored cross-site scripting vulnerability in the Yumpu E-Paper publishing WordPress plugin (versions up to 3.0.8). The issue stems from improper neutralization of input during web page generation, specifically in the 'YUMPU' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary web scripts that execute in the context of users visiting the compromised pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No known exploits in the wild have been reported, and no patch or official fix has been documented as of the published date.

Successful exploitation allows an authenticated user with contributor or higher privileges to inject persistent malicious scripts into pages via the 'YUMPU' shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to limited confidentiality and integrity impacts such as session hijacking or content manipulation. Availability is not impacted. The vulnerability requires low attack complexity but does require authenticated access with some privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Yumpu E-Paper publishing plugin if feasible. Monitor for plugin updates from the vendor addressing this vulnerability.