CVE-2024-13866 is a stored cross-site scripting vulnerability in the appsbd Simple Notification WordPress plugin affecting all versions up to 1.3. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), allowing authenticated administrators to inject malicious scripts. This affects multi-site installations or sites with unfiltered_html disabled, enabling script execution in users' browsers when they visit the injected pages. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, requiring privileges, no user interaction, scope changed, with low confidentiality and integrity impact and no availability impact.

An attacker with administrator-level access can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of affected WordPress sites. This can lead to partial confidentiality and integrity compromise of user data or site content. The vulnerability does not impact availability. It specifically affects multi-site WordPress setups or those with unfiltered_html disabled, limiting the scope of affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator access to trusted users only and consider disabling or removing the Simple Notification plugin in multi-site or unfiltered_html-disabled environments. Monitor official channels for updates or patches from the vendor.