CVE-2024-10148 is a stored cross-site scripting vulnerability in the sohelwpexpert Awesome buttons WordPress plugin, affecting all versions up to 1.0. The issue stems from improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping on user-supplied attributes in the btn2 shortcode. Authenticated attackers with contributor-level permissions or higher can inject arbitrary JavaScript code that executes in the context of users visiting the compromised page. This vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to theft of user credentials, session hijacking, or other actions permitted by the injected script's capabilities. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authenticated access at contributor level or above, reducing the attack surface.

No official patch or fix is currently available for this vulnerability. Users should restrict contributor-level access to trusted individuals and consider disabling or removing the Awesome buttons plugin until a fix is released. Monitor the vendor's advisory channels for updates. Applying strict input validation and output escaping at the application level may mitigate risk but requires custom development.