CVE-2024-10232 is a stored cross-site scripting vulnerability in the Group Chat & Video Chat by AtomChat WordPress plugin (up to version 1.1.5). The issue stems from improper neutralization of input during web page generation, specifically in the plugin's atomchat shortcode. Authenticated users with contributor or higher privileges can inject arbitrary web scripts due to insufficient input sanitization and output escaping of user-supplied attributes. This vulnerability can lead to script execution in the context of other users viewing the injected pages. The CVSS 3.1 base score is 6.4 (medium), with attack vector network, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an authenticated contributor or higher user to inject and execute arbitrary scripts in the context of other users visiting the affected pages. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information accessible via the browser, or other client-side impacts related to script execution. The vulnerability does not affect availability. No known active exploits have been reported.

No official patch or remediation has been documented as of the published date. Users should monitor the vendor's announcements for updates or fixes. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the plugin if feasible. Review and sanitize user inputs where possible to reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.