CVE-2024-11266

CVE-2024-11266 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Geocache Stat Bar Widget WordPress plugin through version 0.911. This flaw allows high-privilege users, such as administrators, to inject malicious scripts into website settings due to insufficient sanitization and escaping, even in environments where unfiltered_html is restricted (e.g., multisite setups). The vulnerability has a CVSS v3.1 score of 4.8 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact on confidentiality and integrity. While it can lead to client-side attacks, the impact is limited as it requires high privileges to exploit. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low awareness and attention to this vulnerability.