CVE-2024-3811 is a stored cross-site scripting vulnerability in the ThemeNectar Salient Shortcodes WordPress plugin affecting all versions up to 1.5.3. The issue arises from improper input sanitization and output escaping of user-supplied attributes in the 'icon' shortcode, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts. These scripts persist in the content and execute when any user accesses the injected page. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts confidentiality and integrity with no impact on availability. No patch or official remediation guidance is currently available.

An authenticated attacker with contributor-level privileges or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized script execution in the context of users viewing the affected pages, potentially compromising user data confidentiality and integrity. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Salient Shortcodes plugin if feasible. Monitor for vendor updates regarding patches or official mitigations.