CVE-2024-11439 is a stored cross-site scripting vulnerability in the ScanCircle WordPress plugin, versions up to and including 2.9.2. The issue is due to improper neutralization of input in the 'scancircle' shortcode, where user-supplied attributes are not adequately sanitized or escaped. Authenticated users with contributor-level access or higher can exploit this to inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. This vulnerability can lead to information disclosure or session hijacking but does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, and impacts confidentiality and integrity with no impact on availability.

An attacker with contributor-level or higher access can inject malicious scripts into pages via the vulnerable shortcode. These scripts execute in the context of users who view the compromised pages, potentially leading to information disclosure or unauthorized actions performed on behalf of users. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the ScanCircle plugin if feasible. Monitor for updates from the vendor regarding patches or official mitigations.