CVE-2024-11446 is a reflected cross-site scripting vulnerability in the Chessgame Shizzle plugin for WordPress, affecting all versions up to and including 1.3.0. The vulnerability is due to improper neutralization of input in the 'cs_nonce' parameter, which is not properly sanitized or escaped before being included in web pages. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they click a crafted link. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impact and no availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of user data or session tokens, or other actions performed with the user's privileges on the affected site. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Chessgame Shizzle plugin or restricting access to affected functionality. Avoid clicking suspicious links that could trigger the vulnerability. Monitor the vendor's channels for updates and apply patches promptly once released.