CVE-2024-12724

CVE-2024-12724 describes a Reflected Cross-Site Scripting (XSS) vulnerability in the WP DeskLite WordPress plugin, affecting versions through 1.0.0. This medium-severity vulnerability (CVSS 6.1) arises from the plugin's failure to properly sanitize and escape a parameter before displaying it, allowing an attacker to inject malicious scripts. While the attack complexity is low and requires user interaction, it could be leveraged against high-privilege users like administrators, potentially leading to information disclosure or unauthorized actions. There is currently no evidence of active exploitation, nor are there Metasploit or ExploitDB modules available, though Nuclei templates exist for detection, and community discussion and media coverage are minimal.