CVE-2024-13462 is a stored cross-site scripting vulnerability in the WP Wiki Tooltip plugin for WordPress, affecting all versions up to and including 2.0.2. The issue arises from improper neutralization of user-supplied input in the 'wiki' shortcode attributes, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4, reflecting a medium severity level. There is no vendor advisory or patch information currently available.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the 'wiki' shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user sessions or performing actions on behalf of users. The impact is limited to confidentiality and integrity loss with no direct availability impact. The vulnerability requires authenticated access, which reduces the attack surface compared to unauthenticated exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the WP Wiki Tooltip plugin if possible. Monitor for updates from the plugin vendor or WordPress security channels for a patch or official mitigation instructions.