CVE-2024-13385 is a stored cross-site scripting vulnerability in the JSM Screenshot Machine Shortcode WordPress plugin (versions up to 2.3.0). The flaw is due to improper neutralization of input during web page generation (CWE-79), specifically insufficient input sanitization and output escaping on user-supplied attributes in the 'ssm' shortcode. Authenticated users with contributor-level permissions or higher can inject arbitrary JavaScript code that executes in the context of any user viewing the compromised page. The CVSS 3.1 base score is 6.4, reflecting a network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no impact on availability.

An attacker with contributor-level access can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the page, potentially compromising user data confidentiality and integrity. There is no reported impact on system availability. No known public exploits have been observed to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only. Consider disabling or removing the JSM Screenshot Machine Shortcode plugin if it is not essential. Monitor for updates from the vendor regarding patches or official mitigations.