CVE-2024-10891 is a stored cross-site scripting vulnerability in the Save as PDF Plugin by Pdfcrowd for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically in the handling of the 'save_as_pdf_pdfcrowd' shortcode attributes. Authenticated users with contributor or higher privileges can inject malicious scripts that persist and execute in the context of users viewing the compromised pages. This vulnerability affects all versions up to 4.2.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated contributor or higher to inject persistent scripts into pages, which execute in the context of users viewing those pages. This can lead to unauthorized actions or data disclosure limited to the confidentiality and integrity impact as per the CVSS score. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.