CVE-2024-11758 is a stored cross-site scripting vulnerability in the WP SPID Italia plugin for WordPress, affecting all versions up to and including 2.9. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode functionality. Authenticated attackers with contributor-level privileges or higher can exploit this flaw to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity without availability impact.

Successful exploitation allows authenticated users with contributor or higher privileges to inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the compromised pages, potentially leading to partial confidentiality and integrity breaches such as session hijacking or unauthorized actions performed in the context of the victim user. There is no direct impact on system availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the WP SPID Italia plugin if feasible. Monitor for plugin updates from the vendor that address this vulnerability.