CVE-2024-11815 is a reflected cross-site scripting vulnerability in the Pósturinn's Shipping with WooCommerce plugin for WordPress, affecting all versions up to 1.3.1. The vulnerability is due to improper neutralization of input in the printed_marked and nonprinted_marked parameters, which are not sufficiently sanitized or escaped before being included in web pages. This allows unauthenticated attackers to inject malicious scripts that execute when a user clicks a crafted link. The CVSS 3.1 base score is 6.1 (medium severity), with an attack vector of network, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or manipulate site content. The impact affects confidentiality and integrity but does not affect availability. Since the vulnerability is reflected XSS, exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking on suspicious links involving the printed_marked and nonprinted_marked parameters. Monitoring for updates from the plugin vendor is recommended. No official patch or temporary fix is currently documented.