CVE-2024-10592 is a stored cross-site scripting vulnerability in the Mapster WP Maps plugin for WordPress, affecting all versions up to 1.6.0. The vulnerability is due to improper neutralization of script-related HTML tags (CWE-80) in the popup class parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses the injected page, potentially compromising user sessions or data. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact.

Successful exploitation allows authenticated users with Contributor or higher privileges to inject persistent malicious scripts into pages viewed by other users. This can lead to partial confidentiality and integrity loss, such as session hijacking or unauthorized actions performed in the context of other users. There is no direct impact on system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the popup class parameter if possible. Monitor for updates from the Mapster plugin vendor and apply official patches promptly once available.