CVE-2024-4439

HIGH 7.2

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

Vendor	wordpress foundation
Product	wordpress
Ecosystems	PHP CMS
Industries	WebMedia
Published	May 3, 2024
Last Updated	Aug 1, 2024

Stay Ahead of the Next One

Get instant alerts for wordpress foundation wordpress

Be the first to know when new high vulnerabilities affecting wordpress foundation wordpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

WordPress Foundation / WordPress

6.0 ≤ 6.0.7 6.1 ≤ 6.1.5 6.2 ≤ 6.2.4 6.3 ≤ 6.3.3 6.4 ≤ 6.4.3 6.5 ≤ 6.5.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/e363c09a-4381-4b3a-951c-9a0ff5669016?source=cve wordpress.org: https://wordpress.org/news/2024/04/wordpress-6-5-2-maintenance-and-security-release/ core.trac.wordpress.org: https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=57950%40%2F&new=57950%40%2F&sfp_email=&sfph_mail=#file3 core.trac.wordpress.org: https://core.trac.wordpress.org/changeset/57951/branches/6.4/src/wp-includes/blocks/avatar.php wordfence.com: https://www.wordfence.com/blog/2024/04/unauthenticated-stored-cross-site-scripting-vulnerability-patched-in-wordpress-core/

Credits

John Blackbourn Matthew Rollings