CVE-2024-11883 is a stored cross-site scripting vulnerability in the Connatix Video Embed WordPress plugin (up to version 1.0.5). It arises from improper neutralization of user-supplied input in the 'cnx_script_code' shortcode, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is confirmed published but lacks a disclosed patch or vendor advisory at this time.

The vulnerability allows authenticated contributors or higher to inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized script execution in the browsers of users who visit those pages, potentially compromising user sessions or performing actions on behalf of users. The impact is limited by the requirement for authenticated contributor-level access, but it still poses a risk to site integrity and user security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Connatix Video Embed plugin if possible to prevent exploitation.