CVE-2024-13497 describes a stored cross-site scripting vulnerability (CWE-80) in the Tripetto WordPress form builder plugin for contact forms, surveys, and quizzes. The issue is due to improper neutralization of script-related HTML tags in attachment uploads, which allows unauthenticated attackers to inject malicious scripts that execute when users view the uploaded content. This affects all versions up to and including 8.0.9. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with scope change.

An attacker can inject and store malicious scripts via attachment uploads in the vulnerable plugin, which execute in the context of users accessing the uploaded files. This can lead to unauthorized disclosure of information and modification of data within the affected web application context. There is no indication of availability impact. The vulnerability affects confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or disabling attachment uploads in the Tripetto plugin to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.