CVE-2024-13403 describes a stored cross-site scripting vulnerability in the WPForms plugin for WordPress, specifically via the 'fieldHTML' parameter. Authenticated users with Contributor-level privileges or above can inject arbitrary web scripts due to improper input neutralization during page generation. This vulnerability affects all versions up to and including 1.9.3.1. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality and integrity but not availability. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the context of users viewing the affected pages, potentially leading to unauthorized actions such as session hijacking, data theft, or privilege escalation within the WordPress environment. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting the use of the vulnerable plugin. Monitor for updates from the plugin vendor or WordPress security advisories to apply any forthcoming patches promptly.