CVE-2024-13565 is a stored cross-site scripting vulnerability in the Simple Map No Api WordPress plugin (shaonback2) affecting all versions up to and including 1.9. The flaw exists due to improper neutralization of input in the 'width' parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute when any user accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity. No patch or official fix is currently documented.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages via the 'width' parameter. This can lead to unauthorized script execution in the context of other users viewing the affected pages, potentially compromising user sessions or data confidentiality and integrity. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the Simple Map No Api plugin if possible. Monitor plugin updates closely for any forthcoming patches addressing this vulnerability.