CVE-2026-10024 is a stored cross-site scripting vulnerability (CWE-79) in the 360crest TinyMCE shortcode Addon plugin for WordPress. The flaw exists in the handling of the 'btnrel' shortcode attribute, where input is not properly sanitized or escaped before being stored and rendered. This allows authenticated attackers with contributor-level privileges or above to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. The vulnerability affects all plugin versions up to and including 1.0.0. No official patch or remediation has been documented as of the publication date.

Successful exploitation allows an attacker with contributor-level access or higher to inject persistent malicious scripts into WordPress pages. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, privilege escalation, or other unauthorized actions within the context of the affected site. The vulnerability does not impact availability but compromises confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the TinyMCE shortcode Addon plugin if feasible. Monitor for updates from the vendor or security advisories for a patch or workaround.