CVE-2024-11502: 
WordPress vulnerability analysis and mitigation

The Planning Center Online Giving WordPress plugin through version 1.0.0 contains a stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-11502. The vulnerability was discovered by Bob Matyas and publicly disclosed on November 3, 2024. This security issue affects WordPress installations using the affected plugin version (WPScan).

The vulnerability stems from the plugin's failure to validate and escape certain shortcode attributes before outputting them back in a page or post where the shortcode is embedded. The issue has been classified under CWE-79 and received a CVSS v3.1 score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (WPScan, Wiz).

The vulnerability allows users with contributor role and above to perform Stored Cross-Site Scripting attacks on affected WordPress installations. This could potentially lead to unauthorized script execution in users' browsers when viewing affected pages (NVD).

Currently, there is no known fix available for this vulnerability. Users of the Planning Center Online Giving WordPress plugin should monitor for updates and consider implementing additional security controls (WPScan).