CVE-2024-13839 is a reflected cross-site scripting vulnerability in the Staff Directory Plugin: Company Directory WordPress plugin by richardgabriel. The issue arises from the use of add_query_arg without proper escaping of URL parameters, enabling injection of malicious scripts. This affects all versions up to and including 4.3. An attacker can exploit this by tricking a user into clicking a malicious link, causing script execution in the user's browser context. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a crafted link. This can lead to information disclosure and integrity impact within the affected web application context. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links related to this plugin and consider disabling or removing the plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.