CVE-2024-13633: 
WordPress vulnerability analysis and mitigation

The Simple catalogue WordPress plugin through version 1.0.2 contains a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-13633. The vulnerability was discovered by Hassan Khan Yusufzai (Splint3r7) and was publicly disclosed on February 4, 2025. This security issue affects the plugin's admin interface and poses a risk particularly to high-privilege users such as administrators (WPScan).

The vulnerability stems from improper input sanitization and escaping of a parameter before it is output back to the page. The issue has been assigned a CVSS score of 7.1 (High) and is classified under CWE-79. The vulnerability falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

When exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of high-privilege users' browsers, potentially leading to unauthorized actions or data theft when administrators access the affected pages (WPScan).

As of the current date, there is no known fix available for this vulnerability. Users of the Simple catalogue WordPress plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).