CVE-2024-10172 is a stored cross-site scripting vulnerability (CWE-79) in the WPBakery Visual Composer WHMCS Elements plugin for WordPress, affecting all versions up to 1.0.4. The vulnerability exists due to improper neutralization of input in the void_wbwhmcse_laouts_search shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts that execute in the context of users visiting the injected pages. This can lead to partial compromise of confidentiality and integrity but does not affect availability. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No known exploits in the wild or vendor patches are currently documented.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the affected pages, potentially allowing theft of sensitive information or manipulation of page content. The impact includes limited confidentiality and integrity loss but no availability impact. The vulnerability requires authenticated access, limiting the attack surface.

Patch status is not yet confirmed — no official fix or patch has been documented by the vendor. Users should monitor the vendor's advisory channels for updates. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected plugin if feasible to prevent exploitation.