The TicketSource Ticket Shop plugin for WordPress versions up to 3.0.2 is vulnerable to stored cross-site scripting due to improper neutralization of input in the 'ticketshop' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users viewing the injected pages. This vulnerability is tracked as CVE-2024-11784 and has a CVSS 3.1 base score of 6.4, indicating a medium severity. The issue stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes. No patch or official remediation guidance is currently documented.

Successful exploitation allows an authenticated user with contributor-level access or higher to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users, potentially compromising confidentiality and integrity of user sessions. The vulnerability does not affect availability. No known public exploits have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the TicketSource Ticket Shop plugin if feasible. Monitor for updates from the vendor regarding patches or temporary mitigations.