CVE-2024-10260 describes a stored cross-site scripting vulnerability (CWE-79) in the Tripetto WordPress form builder plugin for contact forms, surveys, and quizzes. The issue is due to improper neutralization of input during web page generation, specifically related to file uploads. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts that execute in the context of users viewing the infected files. The vulnerability affects all versions up to and including 8.0.11. The CVSS v3.1 base score is 7.2, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users accessing the affected files, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no reported impact on availability. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a patch is available, consider restricting file upload capabilities or implementing additional input validation and output escaping controls as temporary mitigations.