CVE-2024-11428 is a stored cross-site scripting vulnerability in the aishan Lazy load videos and sticky control WordPress plugin. It arises from insufficient input sanitization and output escaping of user-supplied attributes in the plugin's shortcode, allowing authenticated contributors or higher to inject arbitrary scripts. These scripts execute when any user accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 3.0.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the context of users viewing the page, potentially compromising user sessions or performing unauthorized actions. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.