CVE-2024-13455 is a stored cross-site scripting vulnerability in the igumbi Online Booking WordPress plugin (versions up to 1.40). It is caused by improper neutralization of input during web page generation (CWE-79) in the 'igumbi_calendar' shortcode. Authenticated users with contributor or higher privileges can inject arbitrary scripts due to insufficient input sanitization and output escaping of shortcode attributes. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.4 (Network attack vector, Low attack complexity, Privileges required: Low, No user interaction, Scope changed, Low confidentiality and integrity impact, no availability impact). No known exploits in the wild or patches have been reported as of the publication date.

An attacker with contributor-level or higher access can inject malicious scripts into pages via the vulnerable shortcode. These scripts execute in the context of users who view the affected pages, potentially compromising user sessions or performing unauthorized actions. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires authenticated access, reducing the attack surface compared to unauthenticated XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the igumbi Online Booking plugin if possible. Monitor for updates from the vendor regarding official patches or mitigations.