CVE-2024-11870 is a stored cross-site scripting vulnerability in the Event Registration Calendar By vcita WordPress plugin, affecting all versions up to and including 1.4.0. The issue arises from improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied shortcode attributes. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users viewing the injected pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4 (medium severity).

Successful exploitation allows authenticated users with contributor or higher privileges to perform stored XSS attacks, potentially leading to session hijacking, defacement, or other script-based attacks against users who view the compromised pages. The impact is limited by the requirement for authenticated access with at least contributor-level permissions. There is no indication of denial of service or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level and higher access to trusted users only. Monitor plugin updates from vcita and apply any official patches promptly once released. Avoid using the vulnerable shortcode attributes or sanitize inputs manually if possible.