CVE-2024-13690 is a stored cross-site scripting vulnerability (CWE-79) in the WP Church Donation WordPress plugin by ashishajani. It affects all versions up to and including 1.7. The issue is caused by insufficient sanitization and escaping of input parameters in donation form submissions, allowing unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting affected pages, potentially leading to information disclosure and integrity impacts such as session hijacking or defacement. Availability is not impacted. The vulnerability affects confidentiality and integrity with a scope change, indicating that the attacker can affect resources beyond their initial privileges.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, consider disabling or removing the WP Church Donation plugin if possible, or applying manual input sanitization and output escaping as a temporary mitigation.