CVE-2024-13549 is a stored cross-site scripting vulnerability in the All Bootstrap Blocks WordPress plugin by areoimiles, specifically affecting the Accordion widget. Authenticated users with Contributor or higher privileges can inject arbitrary scripts due to improper input neutralization during web page generation. This vulnerability affects all plugin versions up to 1.3.26. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impacts without availability impact.

An attacker with at least Contributor-level access can inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no direct impact on system availability. The vulnerability requires authenticated access, limiting the attack surface to users with some level of trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only. Consider disabling or avoiding use of the Accordion widget in the All Bootstrap Blocks plugin. Monitor for updates from the vendor or plugin maintainers regarding patches or official mitigations.