CVE-2024-10881 is a stored cross-site scripting vulnerability in the sodah LUNA RADIO PLAYER WordPress plugin. It arises from improper neutralization of input during web page generation, specifically in the 'lunaradio' shortcode. Authenticated attackers with contributor-level or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This vulnerability affects versions up to and including 6.24.11.07. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No known exploits in the wild or vendor patches are currently documented.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the injected page, potentially compromising user data confidentiality and integrity. There is no direct impact on system availability. The vulnerability does not require user interaction to trigger once the malicious content is injected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the LUNA RADIO PLAYER plugin if feasible. Monitor for updates from the vendor or security advisories for a patch or official mitigation.