CVE-2024-13363 is a reflected cross-site scripting vulnerability in the Raptive Ads plugin for WordPress, affecting all versions up to and including 3.6.3. The vulnerability is due to improper neutralization of input in the 'poc' parameter, allowing unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they click a crafted link or perform a similar action. The vulnerability has a CVSS 3.1 score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser session, potentially leading to information disclosure or manipulation of user interactions within affected web pages. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Raptive Ads plugin or restricting access to affected parameters. Monitor vendor channels for updates and apply patches promptly once released.