CVE-2024-12098: 
WordPress vulnerability analysis and mitigation

The ARS Affiliate Page Plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-12098) in versions up to and including 2.0.2. The vulnerability exists due to insufficient input sanitization and output escaping of the 'utm_keyword' parameter (NVD).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has received a CVSS v3.1 base score of 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating moderate severity (NVD).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. This could lead to theft of sensitive information or manipulation of user sessions (NVD).

The vulnerability requires user interaction to be exploited, as indicated by the UI:R parameter in the CVSS score. An attacker would need to craft a malicious URL and convince a user to click on it for successful exploitation (NVD).

The vulnerability has been patched in version 2.0.4 of the plugin, which fixes the potential Reflected Cross-Site Scripting issue. Users are advised to update to this version or later to protect against this vulnerability (WordPress Plugin).