CVE-2024-11052 is a stored cross-site scripting vulnerability in the Ninja Forms WordPress plugin (versions up to 3.8.19). The issue is due to improper neutralization of input in the calculations parameter, enabling unauthenticated attackers to inject malicious scripts that execute in the context of users viewing the injected content. This vulnerability can lead to information disclosure and session hijacking but does not impact availability. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to theft of sensitive information, such as cookies or session tokens, and potentially unauthorized actions performed on behalf of the user. There is no impact on system availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable parameter if possible. Monitor official Ninja Forms and WordPress security advisories for updates. Avoid using untrusted input in the calculations parameter and implement web application firewall (WAF) rules to detect and block suspicious payloads related to this vulnerability.