CVE-2024-11935 is a stored cross-site scripting vulnerability in the neotrendy Email Address Obfuscation WordPress plugin affecting all versions up to 1.0.1. The vulnerability is due to improper neutralization of input in the 'class' parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses the injected page, potentially leading to information disclosure or session hijacking. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject and store malicious scripts in pages generated by the plugin. When other users view these pages, the scripts execute in their browsers, potentially leading to unauthorized actions such as data theft or session compromise. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits reported.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Contributor-level access to trusted users only and consider disabling or replacing the Email Address Obfuscation plugin to prevent exploitation.