CVE-2024-11231 is a stored cross-site scripting vulnerability affecting the 우커머스 네이버페이 WordPress plugin up to version 3.3.7. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes in the mnp_purchase shortcode. This allows authenticated users with contributor-level privileges or higher to inject malicious scripts that execute in the context of other users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated contributor-level user or higher to inject and execute arbitrary JavaScript in the context of other users visiting the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed by victim users. There is no impact on availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable shortcode if feasible. Monitor for updates from the plugin vendor or WordPress security advisories to apply an official fix once released.