CVE-2024-13466 is a stored cross-site scripting vulnerability in the Automatically Hierarchic Categories in Menu WordPress plugin (versions up to 2.0.7). The issue arises from inadequate sanitization and escaping of user-supplied attributes in the 'autocategorymenu' shortcode, allowing authenticated contributors or higher to inject arbitrary JavaScript. This script executes in the context of users who access the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability requires at least contributor-level privileges and does not require user interaction beyond page access.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the injected pages, potentially leading to information disclosure or session compromise. The vulnerability does not affect availability and requires authenticated access, limiting its impact to medium severity.

No official patch or remediation is currently documented. Users should monitor the vendor's advisory for updates and consider restricting contributor-level access or disabling the vulnerable plugin until a fix is released. Applying strict input validation or output escaping at the application level may mitigate risk but is not a substitute for an official fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.