CVE-2024-10849 is a stored cross-site scripting vulnerability in the NewsMash WordPress theme by desertthemes affecting all versions up to 1.0.71. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the display name field. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. This can lead to information disclosure and session hijacking. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impact on confidentiality and integrity but not availability. No patch or official fix is currently documented, and no known exploits have been reported.

Successful exploitation allows authenticated users with Contributor or higher privileges to inject persistent malicious scripts into pages viewed by other users. This can result in unauthorized actions performed in the context of victim users, potentially leading to data theft or session compromise. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider additional input validation or output escaping controls at the application or web server level to mitigate risk. Monitor vendor channels for updates regarding patches or official mitigations.