CVE-2024-12815 is a stored XSS vulnerability in the zipang Point Maker WordPress plugin, affecting all versions up to 0.1.6. The issue arises from improper neutralization of input in the 'point_maker' shortcode, where user-supplied attributes are not adequately sanitized or escaped before being rendered in web pages. This allows authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code that executes in the context of any user viewing the compromised page. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or official remediation has been provided by the vendor as of the published date.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Point Maker plugin if feasible. Monitor for updates from the vendor or WordPress plugin repository for a security update addressing this issue.