CVE-2024-10147 is a stored cross-site scripting vulnerability in the Steel WordPress plugin (versions up to 1.3.0). It results from improper neutralization of input in the btn shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of any user viewing the compromised page. This vulnerability has a CVSS 3.1 base score of 6.4 (medium severity) with network attack vector, low attack complexity, and privileges required at the contributor level. No patch or vendor advisory is currently available, and no known exploits have been reported.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the btn shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Steel plugin if possible. Monitor official starverte or WordPress plugin repositories for updates addressing this vulnerability.