CVE-2024-13519 is a stored cross-site scripting vulnerability (CWE-79) in the MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution WordPress plugin. It affects all versions up to 1.9.80 and occurs due to improper neutralization of input during web page generation. Authenticated attackers with Shop Manager-level permissions or higher can inject arbitrary web scripts via the plugin's settings. These scripts execute in the context of users visiting the injected pages. The vulnerability is limited to multi-site WordPress installations with unfiltered_html disabled, increasing the attack surface in such environments. The CVSS 3.1 base score is 4.4, reflecting medium severity with network attack vector, high attack complexity, and required privileges.

Successful exploitation allows an authenticated user with Shop Manager or higher privileges to inject and execute arbitrary JavaScript in the context of other users visiting the affected pages. This can lead to information disclosure or session hijacking limited to the scope of the affected site. The vulnerability does not impact availability and requires specific conditions (multi-site and unfiltered_html disabled). There are no known exploits in the wild at this time.

No official patch or fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit Shop Manager and higher permissions to trusted users only, and consider disabling multi-site installations if feasible. Monitor vendor channels for updates and apply any official patches promptly once available.