CVE-2024-11782 is a stored cross-site scripting vulnerability in the WP Mailster plugin for WordPress, affecting all versions up to and including 1.8.17.0. The issue is due to improper neutralization of input in the 'mst_subscribe' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users visiting the injected pages. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to partial disclosure of information and modification of content within the affected site context. There is no indication of availability impact or known exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider removing or disabling the 'mst_subscribe' shortcode if feasible. Monitor official vendor channels for updates regarding patches or mitigations.