The vulnerability CVE-2024-13799 affects the WordPress plugin 'File Sharing & Download Manager – User Private Files' by deepakkite. It is a stored cross-site scripting (CWE-79) flaw caused by improper neutralization of input during web page generation. Specifically, the 'new-fldr-name' parameter is not properly sanitized or escaped, allowing authenticated users with Subscriber-level privileges or higher to inject malicious scripts. These scripts execute in the context of other users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix information is provided in the available data.

The vulnerability allows authenticated users with Subscriber-level access or higher to inject and store malicious scripts that execute in other users' browsers when they access the affected pages. This can lead to unauthorized actions performed in the context of the victim user, including theft of session tokens or other sensitive information, impacting confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user privileges where possible and monitor for suspicious activity related to the 'new-fldr-name' parameter. Avoid allowing untrusted users to upload or modify folder names. Follow vendor updates closely for any released patches or official mitigations.