CVE-2024-11929 is a stored cross-site scripting vulnerability in the Responsive FlipBook Plugin for WordPress, present in all versions up to 2.5.0. The issue arises from missing authorization (CWE-862) and inadequate input sanitization and output escaping in the rfbwp_save_settings() function. This allows authenticated users with low privileges (Subscriber-level and above) to inject arbitrary web scripts that execute in the context of other users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with at least Subscriber-level access can exploit this vulnerability to inject persistent malicious scripts into pages managed by the plugin. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin access to trusted users only and consider disabling or removing the Responsive FlipBook Plugin if possible. Monitor for updates from the plugin vendor or WordPress plugin repository for a security update addressing this issue.