CVE-2024-13350 is a stored cross-site scripting vulnerability in the SearchIQ – The Search Solution WordPress plugin, affecting all versions up to 4.7. The issue stems from improper neutralization of input in the 'siq_searchbox' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript code that executes in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity with potential confidentiality and integrity impacts but no availability impact. There is no indication of known exploits in the wild or an official patch released at this time.

Successful exploitation allows an authenticated user with contributor-level access or above to inject persistent malicious scripts into pages via the 'siq_searchbox' shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure or manipulation of page content. The vulnerability does not impact availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level and higher access to trusted users only. Consider disabling or removing the SearchIQ plugin if feasible. Monitor for updates from the vendor regarding patches or official mitigations.