CVE-2024-11902 is a stored cross-site scripting vulnerability classified under CWE-79, found in the Slope Widgets plugin for WordPress. The vulnerability exists in the 'slope-reservations' shortcode due to insufficient sanitization and escaping of user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript code into pages generated by this shortcode. When other users visit these pages, the malicious scripts execute in their browsers, potentially allowing attackers to steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. The vulnerability affects all versions of the plugin up to and including 4.2.11. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The scope is changed due to the potential impact on other users viewing the injected content. No public exploits have been reported yet, but the vulnerability is publicly disclosed and should be addressed promptly. The plugin is widely used in WordPress environments, making the vulnerability relevant to many websites globally.

The impact of this vulnerability includes potential compromise of user sessions, unauthorized actions performed on behalf of users, and possible redirection to malicious websites. Since the vulnerability is stored XSS, the malicious payload persists in the website content, affecting all users who access the infected pages. This can lead to credential theft, defacement, or further exploitation of user browsers. For organizations, this can result in data breaches, loss of user trust, reputational damage, and compliance issues. The requirement for contributor-level access limits exploitation to insiders or compromised accounts, but many WordPress sites allow such roles for content creators, increasing risk. The vulnerability does not directly affect availability but compromises confidentiality and integrity of user interactions.

To mitigate this vulnerability, organizations should immediately update the Slope Widgets plugin to a patched version once available. Until a patch is released, restrict contributor-level access to trusted users only and audit existing user roles for unnecessary privileges. Implement Web Application Firewall (WAF) rules to detect and block suspicious input patterns targeting the 'slope-reservations' shortcode. Employ Content Security Policy (CSP) headers to limit script execution sources and reduce impact of injected scripts. Regularly scan WordPress sites for malicious scripts or unusual content injections. Educate site administrators about the risks of granting contributor-level access and enforce strong authentication mechanisms. Additionally, review and sanitize all user-generated content inputs in custom plugins or themes to prevent similar vulnerabilities.