CVE-2024-13706 is a reflected cross-site scripting vulnerability in the WP Image Uploader WordPress plugin by filipmedia. The issue exists due to improper neutralization of input in the 'file' parameter, allowing injection of malicious scripts. This vulnerability affects all plugin versions up to 1.0.1 and requires user interaction (clicking a crafted link) to trigger script execution. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts confidentiality and integrity with no impact on availability. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of the affected site, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality and integrity. The vulnerability does not affect availability. The medium CVSS score reflects these impacts and the requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Image Uploader plugin or applying manual input sanitization and output escaping if possible. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor filipmedia's official channels for updates and patches.