CVE-2024-10184 is a stored cross-site scripting vulnerability in the StreamWeasels Kick Integration WordPress plugin (up to version 1.1.1). The flaw arises from improper neutralization of user-supplied input in the sw-kick-embed shortcode, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts. These scripts execute in the context of any user viewing the compromised page, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (medium), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized script execution in the browsers of users viewing those pages, potentially resulting in data theft, session hijacking, or other client-side attacks. The vulnerability does not affect availability and requires authenticated access, limiting the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the StreamWeasels Kick Integration plugin if possible. Monitor for plugin updates that address this vulnerability.