The vulnerability CVE-2024-13431 affects the Simply Schedule Appointments Booking Plugin for WordPress, specifically versions up to 1.6.8.3. It is a reflected cross-site scripting (CWE-79) issue caused by improper neutralization of input during web page generation. The parameters accent_color and background do not have sufficient input sanitization or output escaping, enabling attackers to inject malicious scripts that execute when a user interacts with a crafted link. The vulnerability requires no privileges and only user interaction (clicking a link) to be exploited. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website for users who click on a malicious link. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of displayed content. There is no direct impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should avoid clicking on suspicious links involving the affected plugin parameters. Monitoring vendor channels for updates is recommended. No official fix or patch links are currently provided.