CVE-2024-10108 is a stored cross-site scripting vulnerability in the WPAdverts – Classifieds Plugin for WordPress, affecting all versions up to 2.1.6. The issue occurs due to improper neutralization of input in the adverts_add shortcode, enabling unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability can lead to information disclosure and integrity impacts but does not affect availability. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and scope change.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to information disclosure and modification of content. There is no impact on system availability. The vulnerability affects confidentiality and integrity of user data within the affected WordPress plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the adverts_add shortcode or applying custom input sanitization and output escaping as a temporary mitigation. Monitor the vendor's communications for an official patch or update.