CVE-2024-13586 is a stored cross-site scripting vulnerability in the Masy Gallery plugin for WordPress, affecting all versions up to and including 1.7. The issue arises from insufficient sanitization and escaping of user-supplied attributes in the 'justified-gallery' shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of any user who visits the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages using the vulnerable shortcode. When other users access these pages, the injected scripts execute in their browsers, potentially compromising user sessions or data confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Masy Gallery plugin if feasible. Monitor for updates from the vendor or WordPress plugin repository for a security update addressing this vulnerability.