CVE-2024-11452 is a stored cross-site scripting vulnerability in the Chamber Dashboard Business Directory WordPress plugin (versions up to 3.3.8). The issue is due to improper neutralization of input in the 'business_categories' shortcode, which fails to properly sanitize and escape user-supplied attributes. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the injected pages. This vulnerability can lead to partial compromise of confidentiality and integrity of user sessions or data.

Exploitation allows authenticated users with contributor-level access or above to inject persistent malicious scripts into pages via the vulnerable shortcode. When other users access these pages, the injected scripts execute, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of users. The vulnerability does not impact availability. The CVSS vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, and scope change, with limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the 'business_categories' shortcode if possible to mitigate risk. Monitor official gwendydd plugin channels for updates or patches addressing this vulnerability.