CVE-2024-13516 is a reflected cross-site scripting vulnerability in the Kubio AI Page Builder plugin for WordPress, affecting all versions up to 2.3.5. The vulnerability is due to improper neutralization of input in the 'message' parameter, enabling unauthenticated attackers to inject and execute arbitrary web scripts if a user is tricked into clicking a malicious link. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected site, potentially leading to partial confidentiality and integrity impacts such as theft of user data or session tokens. The vulnerability requires user interaction (clicking a crafted link) and affects the web page generation process. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin and avoid interacting with untrusted links that may exploit this vulnerability. Monitor the vendor's communications for updates on patches or official mitigations.