CVE-2024-11195 is a stored cross-site scripting vulnerability in the nik00726 Email Subscription Popup WordPress plugin. The flaw exists in the print_email_subscribe_form shortcode due to improper neutralization of input during web page generation (CWE-79). Authenticated users with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. This vulnerability affects all plugin versions up to and including 1.2.22. No vendor advisory or patch information is provided in the available data.

Successful exploitation allows an authenticated contributor or higher user to inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity loss of user data in the browser context, with no direct availability impact. The CVSS vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Email Subscription Popup plugin if possible. Monitor plugin updates from nik00726 for a security patch addressing this issue.