CVE-2024-11906 is a stored cross-site scripting vulnerability in the TPG Get Posts WordPress plugin (versions up to 3.6.5). The issue stems from improper neutralization of input in the 'tpg_get_posts' shortcode, where user-supplied attributes are not adequately sanitized or escaped. Authenticated attackers with contributor-level access or higher can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. This can lead to partial confidentiality and integrity impacts without affecting availability.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. When other users access these pages, the injected scripts execute in their browsers, potentially leading to theft of sensitive information or unauthorized actions within the context of the affected site. The vulnerability does not impact system availability. The CVSS vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and scope change.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restrict contributor-level access to trusted users only and consider disabling or removing the TPG Get Posts plugin if possible to prevent exploitation.