CVE-2024-13701 is a stored cross-site scripting vulnerability in the Liveticker plugin for WordPress (by stklcode) affecting all versions up to 1.2.2. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes in the 'liveticker' shortcode. Authenticated attackers with contributor-level privileges or higher can inject malicious scripts that execute in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who view the affected pages, potentially leading to unauthorized actions or data disclosure limited to the scope of the injected script. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Liveticker plugin if possible. Monitor for updates from the vendor or plugin author for an official patch or mitigation instructions.