CVE-2024-11853 is a stored cross-site scripting vulnerability in the jAlbum Bridge WordPress plugin caused by improper input sanitization and output escaping of the ‘ar’ parameter. Authenticated attackers with Contributor-level privileges or above can exploit this flaw to inject arbitrary web scripts into pages, which execute upon page access by other users. The vulnerability affects all versions up to 2.0.16. Although version 2.0.16 attempted a fix, it was incomplete, and version 2.0.17 fully remediates the issue.

Exploitation allows authenticated users with Contributor or higher privileges to inject malicious scripts that execute in the context of other users viewing the compromised pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of other users. There is no impact on availability reported. No known exploits are currently observed in the wild.

Upgrade the jAlbum Bridge plugin to version 2.0.17 or later, as this version fully addresses the vulnerability. Versions up to and including 2.0.16 are vulnerable, and the patch in 2.0.16 is insufficient. No other mitigations are indicated by the vendor advisory.