CVE-2024-13883 is a Cross-Site Request Forgery vulnerability in the WPUpper Share Buttons plugin for WordPress, affecting all versions up to and including 3.51. The issue arises from missing or incorrect nonce validation on the 'save_custom_css_request' function, which handles custom CSS saving. An attacker can exploit this by crafting a forged request that, when executed by an authenticated administrator (e.g., via clicking a malicious link), injects arbitrary CSS into the site. This could lead to visual or UI manipulation but does not directly compromise confidentiality or availability.

The vulnerability allows an attacker to inject custom CSS into a WordPress site by exploiting CSRF, potentially altering the site's appearance or user interface. There is no direct impact on data confidentiality or site availability. The attack requires user interaction from an administrator, limiting the ease of exploitation. No known exploits are reported in the wild at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should avoid clicking on untrusted links while logged into the WordPress admin interface and consider disabling or removing the WPUpper Share Buttons plugin if possible.