CVE-2024-10374 describes a stored cross-site scripting vulnerability in the WP-Members Membership Plugin for WordPress, specifically in the wpmem_loginout shortcode. Due to improper input sanitization and output escaping, authenticated users with contributor-level privileges or above can inject arbitrary scripts that execute in other users' browsers upon page access. This vulnerability affects all plugin versions up to and including 3.4.9.5. The CVSS 3.1 base score is 6.4, reflecting a network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. No known exploits in the wild or vendor patches are currently documented.

An attacker with contributor-level or higher access can inject malicious scripts into pages via the vulnerable shortcode. These scripts execute in the context of other users visiting the page, potentially leading to session hijacking, data theft, or other malicious actions affecting confidentiality and integrity. There is no direct impact on system availability. The vulnerability requires authenticated access, limiting exposure to users with some level of trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level and higher user permissions to trusted users only. Consider disabling or avoiding use of the wpmem_loginout shortcode if possible. Monitor for vendor updates and apply patches promptly once available.