CVE-2024-10342 is a stored cross-site scripting vulnerability in the tezzeract League of Legends Shortcodes WordPress plugin. The issue stems from improper neutralization of input during web page generation (CWE-79), specifically due to inadequate input sanitization and output escaping of shortcode attributes. Authenticated users with contributor-level or higher privileges can inject arbitrary JavaScript code that executes in the context of other users viewing the injected pages. The vulnerability affects versions up to and including 1.0.1. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no impact on system availability. No known active exploitation has been reported.

No official patch or remediation has been identified in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.