CVE-2024-11092 is a stored cross-site scripting vulnerability in the SVGPlus plugin for WordPress, affecting all versions up to and including 1.1.0. The flaw allows authenticated users with Author-level access or above to upload SVG files containing malicious scripts via the REST API. Due to improper input sanitization and output escaping, these scripts execute in the context of users viewing the SVG files, potentially compromising confidentiality and integrity. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated user with Author-level privileges to inject and store malicious scripts that execute in the browsers of users who view the SVG files. This can lead to partial confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict Author-level access to trusted users only and consider disabling or limiting SVG file uploads via the REST API if possible. Implementing additional input validation or web application firewall rules targeting SVG uploads may provide temporary mitigation.