CVE-2024-13591 is a stored cross-site scripting vulnerability (CWE-79) in the Team Builder For WPBakery Page Builder WordPress plugin, affecting all versions up to 1.0. The issue stems from improper neutralization of input during web page generation, specifically in the 'team-builder-vc' shortcode, allowing authenticated contributors or higher to inject arbitrary scripts. These scripts execute in the context of users viewing the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability requires network access and low attack complexity but does not require user interaction beyond viewing the page.

Successful exploitation allows an authenticated user with contributor-level or higher privileges to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure and integrity impacts such as session hijacking or unauthorized actions performed on behalf of the victim user. Availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restrict contributor-level access to trusted users only and consider disabling or removing the affected plugin if possible to mitigate risk.