CVE-2024-3513 is a stored cross-site scripting vulnerability in the Ultimate Blocks WordPress plugin affecting all versions up to 3.1.9. The flaw arises from insufficient sanitization and escaping of the postTitleTag parameter, allowing authenticated users with contributor or higher roles to inject arbitrary scripts. These scripts execute in the context of users viewing the injected content, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity. There is no vendor advisory or patch information available at this time, and the plugin is not a cloud service, so remediation depends on vendor or community updates.

An attacker with contributor or higher privileges can exploit this vulnerability to inject stored malicious JavaScript code into pages via the postTitleTag parameter. When other users access these pages, the injected scripts execute in their browsers, potentially leading to information disclosure or session compromise. The vulnerability does not affect availability and requires authenticated access with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor and higher privileges to trusted users only and consider disabling or removing the Ultimate Blocks plugin if possible to mitigate risk.