CVE-2024-11867 is a stored cross-site scripting vulnerability in the Companion Portfolio – Responsive Portfolio Plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically in the 'companion-portfolio' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts that execute in the context of users visiting the compromised pages. This can lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability affects all plugin versions up to and including 2.4.0.1.

Successful exploitation allows an authenticated user with contributor-level access or above to inject malicious scripts that execute in the browsers of users who view the injected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. There is no impact on system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any official patches once released. Until then, restrict contributor-level access to trusted users only and consider disabling or removing the plugin if possible to mitigate risk.