CVE-2024-11888 is a stored cross-site scripting vulnerability in the IDer Login for WordPress plugin. It arises from improper neutralization of user-supplied input in the 'ider_login_button' shortcode, allowing authenticated users with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of any user who accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 2.1. Although the vendor reportedly patched the issue in version 2.1, no updated version containing the fix has been released, so the vulnerability remains unpatched in available plugin versions.

An attacker with contributor-level or higher access can inject malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

Currently, no patched version of the plugin is publicly available despite the vendor indicating a fix in version 2.1. Users should avoid using the 'ider_login_button' shortcode or restrict contributor-level access until an official patched release is published. Monitor the vendor's communications for an official update containing the fix. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.