CVE-2024-11778: 
WordPress vulnerability analysis and mitigation

The CanadaHelps Embedded Donation Form plugin for WordPress (version <= 1.0.0) was identified with a Stored Cross-Site Scripting vulnerability, assigned CVE-2024-11778. The vulnerability was discovered and publicly disclosed on February 18, 2025, with the plugin being temporarily closed for full security review as of the same date (Wordfence Intel, WordPress Plugin).

The vulnerability has been assigned a CVSS score of 6.4 (Medium) and affects the plugin's 'embedcdn' functionality. The vulnerability requires authenticated access at the Contributor level or higher to exploit (Wordfence Intel).

When successfully exploited, this stored cross-site scripting vulnerability could allow authenticated attackers to inject malicious scripts that would execute in other users' browsers when viewing affected pages, potentially leading to unauthorized access to sensitive information or manipulation of user sessions (Wordfence Intel).

As an immediate security measure, the plugin has been temporarily closed and is no longer available for download from the WordPress plugin repository pending a full security review. Users are advised to disable and remove the plugin until a patched version becomes available (WordPress Plugin).