CVE-2024-11750 is a stored cross-site scripting vulnerability in the ONLYOFFICE DocSpace WordPress plugin (up to version 2.1.1). The issue stems from improper neutralization of input during web page generation, specifically in the 'onlyoffice-docspace' shortcode. Authenticated users with contributor or higher privileges can inject malicious scripts via user-supplied shortcode attributes, which are not properly sanitized or escaped. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the affected pages, potentially allowing theft of session tokens, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authenticated access, reducing the attack surface compared to unauthenticated exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Consider disabling or removing the ONLYOFFICE DocSpace plugin if it is not essential. Monitor official ONLYOFFICE channels for updates or patches addressing this vulnerability.