CVE-2024-13749 affects the era404 StaffList WordPress plugin by lacking proper nonce validation on the 'stafflist' page, enabling Cross-Site Request Forgery attacks. An attacker can exploit this by tricking an authenticated administrator into executing a forged request that updates plugin settings and injects malicious web scripts. This vulnerability is categorized under CWE-79, indicating improper input neutralization leading to Cross-site Scripting. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity with no impact on availability. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows an attacker to perform unauthorized changes to the StaffList plugin settings and inject malicious scripts by leveraging an administrator's interaction with a crafted request. This can lead to partial confidentiality and integrity loss of the affected WordPress site. There is no indication of availability impact. The vulnerability requires user interaction (administrator clicking a link) and can be exploited remotely without prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests related to the StaffList plugin. Monitoring for plugin updates from era404 and applying them promptly when released is recommended.