CVE-2024-13748 is a stored cross-site scripting vulnerability in the Ultimate Classified Listings WordPress plugin by webcodingplace. The flaw exists in the handling of the Title parameter, where input is not properly sanitized or escaped before being rendered in web pages. This allows authenticated users with administrator privileges to inject arbitrary scripts that execute in the context of other users viewing the injected pages. The issue specifically affects multi-site WordPress installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access on affected WordPress multi-site installations or with unfiltered_html disabled can inject malicious scripts via the Title parameter. These scripts execute in the browsers of users who view the compromised pages, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not affect availability and requires high privileges and complex attack conditions, limiting its impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit administrator access to trusted users only and consider disabling or removing the Ultimate Classified Listings plugin on multi-site installations or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once released.