CVE-2024-11333 is a stored cross-site scripting vulnerability in the r00tsector HLS Player WordPress plugin, affecting all versions up to 1.0.10. The issue stems from improper neutralization of input in the 'hls_player' shortcode, where user-supplied attributes are not adequately sanitized or escaped. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary web scripts that execute in the context of users visiting the compromised pages. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the HLS Player plugin if possible. Monitor for updates from the vendor or r00tsector project regarding patches or official mitigations.