CVE-2024-11754 is a stored cross-site scripting vulnerability in the Booking System Trafft WordPress plugin (versions up to 1.0.6). The issue stems from improper neutralization of input in the 'trafftbooking' shortcode, where user-supplied attributes are not properly sanitized or escaped before being output in web pages. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages.

Successful exploitation allows an attacker with contributor-level access to inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially enabling theft of session tokens, user impersonation, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent as reflected by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None).

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict contributor-level access to trusted users only and consider disabling or removing the 'trafftbooking' shortcode until a fix is released. Avoid exposing pages with this shortcode to untrusted users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.