CVE-2024-12405: 
WordPress vulnerability analysis and mitigation

The Export Customers Data plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-12405) that affects all versions up to and including 1.2.3. The vulnerability was disclosed on December 24, 2024 and stems from insufficient input sanitization and output escaping in the plugin (NVD).

The vulnerability exists due to improper sanitization of the 't' parameter in the Export Customers Data plugin. This Cross-Site Scripting (XSS) vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The weakness is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The impact primarily affects confidentiality and integrity at a low level, while availability is not impacted (NVD).

Users should upgrade to a version newer than 1.2.3 when available. As this is a recently disclosed vulnerability, specific patch information is pending (NVD).