CVE-2024-11755 is a stored cross-site scripting vulnerability in the IMS Countdown plugin for WordPress, affecting all versions up to and including 1.3.5. The vulnerability is due to improper neutralization of input during web page generation (CWE-79), specifically in the Countdown post settings. Authenticated attackers with Contributor-level permissions or higher can inject arbitrary web scripts that execute in the context of users viewing the injected pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required. No patch or remediation details are currently available from the vendor or other sources.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject malicious scripts into pages, which execute when viewed by other users. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. The vulnerability requires user interaction (viewing the injected page) and privileges to contribute content, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the IMS Countdown plugin if possible. Monitor for updates from acewebx regarding patches or official mitigations.