CVE-2024-10886 is a stored cross-site scripting vulnerability in the Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress, affecting all versions up to and including 1.0.4. The issue stems from improper neutralization of input during web page generation, specifically in the 'tribute_testimonials_slider' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

Successful exploitation allows authenticated users with contributor or higher privileges to inject and execute arbitrary scripts in the browsers of users who visit the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or modification of page content. There is no impact on availability. The vulnerability affects the confidentiality and integrity of user interactions with the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Tribute Testimonials plugin if possible. Monitor official vendor channels for updates and apply patches promptly once released.