CVE-2024-10117 is a stored cross-site scripting vulnerability in the WP Crowdfunding WordPress plugin (themeum) affecting all versions up to 2.1.11. The issue is due to improper neutralization of input in the wpcf_donate shortcode, allowing authenticated users with contributor or higher privileges to inject malicious scripts. These scripts execute in the context of other users viewing the injected content, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium impact with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with contributor-level access or higher can inject persistent malicious scripts via the wpcf_donate shortcode. These scripts execute in the browsers of users who view the affected pages, potentially leading to information disclosure and integrity impacts. Availability is not affected. The vulnerability does not require user interaction but does require authenticated access with specific privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the wpcf_donate shortcode. Monitor for updates from the themeum vendor regarding patches or official mitigations.