The vulnerability CVE-2024-13901 is a DOM-based stored cross-site scripting flaw in the 'Counter Box' WordPress plugin. It stems from improper neutralization of input during web page generation, specifically via the 'content' parameter. Authenticated administrators can exploit this to inject malicious scripts that execute in the context of users visiting the injected pages. The vulnerability affects multi-site WordPress setups or installations with unfiltered_html disabled. The CVSS 3.1 base score is 4.4 (medium), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity. No patch or official fix has been documented in the provided data.

An attacker with administrator-level access on affected WordPress installations can inject arbitrary web scripts via the vulnerable 'content' parameter. This can lead to unauthorized script execution in users' browsers, potentially compromising user data confidentiality and integrity. The vulnerability does not impact availability. It is limited to multi-site or unfiltered_html-disabled environments, reducing the overall attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the vulnerable plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates or patches addressing this vulnerability.