CVE-2024-11748 is a stored cross-site scripting vulnerability in the Taeggie Feed plugin for WordPress, present in all versions up to 0.1.9. The issue arises from improper neutralization of input during web page generation, specifically in the handling of the 'taeggie-feed' shortcode attributes. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the compromised pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (medium), with network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of user credentials, session tokens, or other sensitive information accessible via the browser context. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Taeggie Feed plugin if it is not essential. Monitor for updates from the plugin vendor or WordPress security advisories for an official fix.