CVE-2024-12628 is a stored cross-site scripting vulnerability in the bodi0`s Easy cache WordPress plugin, affecting all versions up to and including 0.8. The issue stems from improper neutralization of input in the 'cache-folder' parameter, allowing authenticated administrators in multi-site or restricted unfiltered_html environments to inject arbitrary scripts. These scripts execute when users visit the compromised pages, potentially impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 4.4, reflecting a medium severity with network attack vector, high attack complexity, and required privileges at the administrator level.

Successful exploitation allows authenticated administrators to inject stored malicious scripts into pages, which execute in the context of users visiting those pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed by users. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site and unfiltered_html disabled). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the bodi0`s Easy cache plugin in multi-site environments or where unfiltered_html is disabled. Monitor official vendor channels for updates or patches addressing this vulnerability.