CVE-2024-13549

CVE-2024-13549 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the All Bootstrap Blocks plugin for WordPress, versions up to and including 1.3.26. This flaw, due to insufficient input sanitization and output escaping in the "Accordion" widget, allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. When a user views an affected page, these scripts will execute, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low attack complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. While the EPSS score is very low, suggesting a low likelihood of exploitation, the FAUCET Risk Score is 20/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for the vast majority of reported vulnerabilities.