CVE-2024-12701 is a reflected cross-site scripting vulnerability in the WP Smart Import : Import any XML File to WordPress plugin, affecting all versions up to 1.1.2. The issue stems from improper neutralization of input in the 'page' parameter, enabling attackers to inject malicious scripts that execute in the context of a victim's browser upon interaction. The vulnerability requires no privileges and has a low attack complexity but requires user interaction. It impacts confidentiality and integrity but not availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser session when the victim interacts with a maliciously crafted link. This can lead to theft of sensitive information, session hijacking, or other client-side impacts. There is no indication of impact on server availability or integrity beyond the client-side effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin and avoid interacting with untrusted links that may exploit this vulnerability.