CVE-2024-11786 is a stored cross-site scripting vulnerability in the Login with Vipps and MobilePay WordPress plugin (versions up to 1.3.3). The issue stems from improper neutralization of input during web page generation, specifically in the 'continue-with-vipps' shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users viewing the compromised pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. No known exploits are reported in the wild, and no patch or vendor advisory has been provided to date.

Successful exploitation allows authenticated users with contributor or higher privileges to inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of other users. There is no impact on availability. The vulnerability requires authentication and is exploitable over the network with low attack complexity and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for plugin updates from wphostingdev that address this vulnerability.