CVE-2024-10185 is a stored cross-site scripting vulnerability in the StreamWeasels YouTube Integration plugin for WordPress, affecting all versions up to 1.3.2. The flaw is due to improper neutralization of input in the sw-youtube-embed shortcode, allowing authenticated users with contributor or higher privileges to inject malicious scripts. These scripts execute in the context of any user viewing the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting medium severity with network attack vector and low complexity. No patch or official fix has been published by the vendor as of the provided data.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the StreamWeasels YouTube Integration plugin if possible. Monitor for updates from the vendor regarding patches or mitigations.