CVE-2024-10176 is a stored cross-site scripting vulnerability in the Compact WP Audio Player WordPress plugin (versions up to 1.9.13). The flaw arises from improper neutralization of user-supplied input in the sc_embed_player shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of any user who views the compromised page, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (medium severity), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, and impacting confidentiality and integrity with no availability impact.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages using the vulnerable shortcode. When other users access these pages, the injected scripts execute in their browsers, potentially leading to theft of sensitive information, session tokens, or other malicious actions within the context of the affected site. The vulnerability does not impact availability but affects confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Compact WP Audio Player plugin if feasible. Monitor for updates from the vendor or WordPress plugin repository for a security patch addressing this issue.