CVE-2024-4439

Description

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

How to fix CVE-2024-4439

To remediate CVE-2024-4439, upgrade the affected package to a fixed version below.

• —upgrade to 6.0.8 or later
• —upgrade to 6.0.8 or later
• —upgrade to 6.1.9+dfsg1-0+deb12u1 or later

Is CVE-2024-4439 being exploited?

Likely — EPSS is 90.6%, placing CVE-2024-4439 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (3)

• >= 6.0.0, < 6.0.8, >= 6.1.0, < 6.1.6, >= 6.2.0, < 6.2.5, >= 6.3.0, < 6.3.4, >= 6.4.0, < 6.4.4, >= 6.5.0, < 6.5.2
• >= 6.0.0, < 6.0.8, >= 6.1.0, < 6.1.6, >= 6.2.0, < 6.2.5, >= 6.3.0, < 6.3.4, >= 6.4.0, < 6.4.4, >= 6.5.0, < 6.5.2
• from 0, < 6.1.9+dfsg1-0+deb12u1

CVSS scores

References (7)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2024-4439
• WEBcore.trac.wordpress.org/changeset/57951/branches/6.4/src/wp-includes/blocks/avatar.php
• WEBcore.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=57950%40%2F&new=57950%40%2F&sfp_email=&sfph_mail=#file3
• WEBnvd.nist.gov