CVE-2024-11899 is a stored cross-site scripting vulnerability in the Slider Pro Lite WordPress plugin (versions up to 1.4.1). The issue stems from improper neutralization of input during web page generation (CWE-79), specifically in the 'sliderpro' shortcode. Authenticated users with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability requires network access and low attack complexity but does require privileges and no user interaction.

An attacker with contributor-level access or higher can inject malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the injected pages, potentially leading to theft of user data or session tokens (confidentiality impact) and modification of displayed content (integrity impact). There is no direct impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Consider removing or disabling the Slider Pro Lite plugin if contributor access cannot be tightly controlled. Monitor for plugin updates from bqworks that address this vulnerability.