CVE-2024-10682 is a reflected cross-site scripting vulnerability in the mikewire_rocksolid Announcement & Notification Banner – Bulletin WordPress plugin. The issue stems from the use of add_query_arg and remove_query_arg functions without proper escaping of URL parameters, allowing injection of arbitrary web scripts. This affects all versions up to and including 3.11.7. Exploitation requires user interaction, such as clicking a malicious link, and can lead to script execution in the context of the victim's browser session.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of cookies, session tokens, or other sensitive information accessible to the browser. The vulnerability requires user interaction and does not grant direct system access or denial of service. The CVSS score of 6.1 reflects a medium impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links related to the affected plugin and consider disabling or removing the plugin if possible. Monitor the vendor's announcements for updates or patches addressing this vulnerability.