CVE-2026-10024 is a stored cross-site scripting vulnerability in the 360crest TinyMCE shortcode Addon plugin for WordPress. It affects all versions up to 1.0.0 due to improper neutralization of input in the 'btnrel' shortcode attribute. Authenticated users with contributor-level privileges or higher can inject malicious scripts that persist in the content and execute in the context of any user viewing the injected page. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity without availability impact. No official fix or patch has been published by the vendor as of the latest information.

An attacker with contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into WordPress pages via the 'btnrel' shortcode attribute. These scripts execute in the context of users who view the compromised pages, potentially leading to partial confidentiality and integrity loss. This could allow theft of user session data, defacement, or other script-based attacks within the affected site. There is no known impact on availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the TinyMCE shortcode Addon plugin if feasible. Monitor for updates from the vendor or security advisories for a patch or official mitigation steps.