CVE-2025-11824 is a stored cross-site scripting vulnerability in the madebycinza Cinza Grid WordPress plugin affecting all versions up to 1.2.1. The vulnerability exists because the plugin fails to properly sanitize and escape input in the 'cgrid_skin_content' post meta field. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. This can lead to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact with no availability impact.

An attacker with contributor-level or higher access can inject malicious scripts that execute in other users' browsers when they access the injected pages. This can lead to partial confidentiality and integrity loss, such as theft of session tokens or manipulation of page content. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the Cinza Grid plugin if possible. Monitor official vendor channels for updates or patches addressing this vulnerability.