CVE-2024-11760 is a stored cross-site scripting vulnerability in the falselight Currency Converter Widget ⚡ PRO WordPress plugin, affecting all versions up to and including 1.0.6. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes in the 'currency-converter-widget-pro' shortcode. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity with no impact on availability.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. There are no reported active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider removing or disabling the Currency Converter Widget ⚡ PRO plugin if possible. Monitor for updates from the vendor and apply any official patches promptly once available.