CVE-2024-11753 is a stored cross-site scripting vulnerability in the UMich OIDC Login WordPress plugin (versions ≤ 1.2.0). It occurs due to improper neutralization of input in the 'umich_oidc_button' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the infected pages. This vulnerability can lead to information disclosure or session manipulation but does not affect availability. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No patch or official remediation guidance is currently documented.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to limited confidentiality and integrity impacts such as session hijacking or data theft. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the 'umich_oidc_button' shortcode to prevent exploitation.