CVE-2024-13573 is a stored cross-site scripting vulnerability in the Zigaform – Form Builder Lite WordPress plugin, affecting all versions up to 7.4.2. The issue stems from improper neutralization of input in the 'zgfm_rfvar' shortcode, which fails to sanitize and escape user-supplied attributes adequately. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This vulnerability can lead to information disclosure or session hijacking but does not affect availability.

Successful exploitation allows authenticated users with contributor or higher privileges to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to limited confidentiality and integrity impacts, such as theft of user credentials or unauthorized actions performed on behalf of users. There is no impact on system availability. No known active exploits have been reported.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'zgfm_rfvar' shortcode if possible. Applying strict input validation and output escaping on user inputs within the plugin code can mitigate risk if custom development resources are available.