CVE-2024-11382 is a stored cross-site scripting vulnerability in the Common Ninja WordPress plugin (up to version 1.1.0). The issue stems from improper neutralization of input during web page generation, specifically in the 'commonninja' shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity).

The vulnerability allows authenticated users with contributor-level or higher privileges to inject and store malicious scripts that execute in the browsers of users who access the affected pages. This can lead to information disclosure or unauthorized actions performed on behalf of the victim user. However, the attack requires authentication with at least contributor privileges, limiting the attack surface. There is no indication of denial of service or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Consider disabling or removing the Common Ninja plugin if contributor access cannot be tightly controlled. Monitor for plugin updates from the vendor addressing this vulnerability.