CVE-2024-11226 is a stored cross-site scripting vulnerability in the FireCask Like & Share Button WordPress plugin by alexmoss. The vulnerability exists due to improper neutralization of input in the 'width' parameter, allowing authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.2. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the low level, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with Contributor-level or higher access can inject persistent malicious scripts via the 'width' parameter. When other users access the compromised pages, these scripts execute in their browsers, potentially exposing sensitive information or enabling further attacks. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the FireCask Like & Share Button plugin if possible. Monitor for plugin updates from the vendor that address this vulnerability.