CVE-2024-13349 is a stored cross-site scripting vulnerability in the Stockdio Historical Chart WordPress plugin. It affects all versions up to and including 2.8.18 due to improper neutralization of input in the 'stockdio-historical-chart' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the compromised pages. The CVSS 3.1 base score is 6.4 (medium), with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated user with contributor-level access or higher to inject malicious scripts that execute in other users' browsers when they access the injected pages. This can lead to unauthorized disclosure of information and modification of content within the affected WordPress site context. There is no indication of availability impact or known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and above to trusted users only. Monitor for plugin updates from the vendor that address this vulnerability and apply them promptly once released.