CVE-2024-13650 is a stored cross-site scripting vulnerability in the Piotnet Addons For Elementor WordPress plugin, specifically in the 'PAFE Before After Image Comparison Slider' widget. The flaw allows authenticated users with Contributor-level privileges or above to inject arbitrary web scripts due to improper neutralization of input during web page generation. This vulnerability affects all versions up to and including 2.4.36. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with Contributor-level access or higher can inject malicious scripts that execute in the context of other users viewing the compromised pages. This can lead to unauthorized actions or data disclosure limited to the scope of the affected site. There is no indication of availability impact or known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable widget if possible. Monitor for updates from the vendor regarding patches or official mitigations.