CVE-2024-4439

mediumPriorität · beachten · 59EPSS 0.710 · 99. PerzentilExploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

5 exploits · PoC

Likely / severe?

71.0% (99th) EPSS

CVSS 6.1 · medium

Is it mine?

42 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-26

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.2

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.1–7.2

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7

v3.17.2highAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · security@wordfence.comAusnutzbarkeit 3.9 · Auswirkung 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Hsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-79USCWE-80US

Exploits (5)

Öffentlicher Proof-of-Concept- und Exploit-Code.

MielPopsssssss/CVE-2024-4439CVE-2024-4439 PoCPoC · poc_in_github
d0rb/CVE-2024-4439The provided exploit code leverages a stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-4439) in WordPress Core versions up to 6.5.1.PoC · poc_in_github
soltanali0/CVE-2024-4439aaPoC · poc_in_github
w0r1i0g1ht/CVE-2024-4439CVE-2024-4439 docker and pocPoC · poc_in_github
xssor-dz/-CVE-2024-4439WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar BlockPoC · poc_in_github

betroffene Produkte (42)

Betroffene Produkte und Versionsbereiche.

Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Open Source WordPress <6.1.6alle Versionencert_bundDE
Open Source WordPress <6.2.5alle Versionencert_bundDE
Open Source WordPress <6.3.4alle Versionencert_bundDE
Open Source WordPress <6.4.4alle Versionencert_bundDE
Open Source WordPress <6.5.2alle Versionencert_bundDE
Open Source WordPress< 6.1.6cert_bundDE
Open Source WordPress< 6.2.5cert_bundDE
Open Source WordPress< 6.3.4cert_bundDE
Open Source WordPress< 6.4.4cert_bundDE
Open Source WordPress< 6.5.2cert_bundDE
WordPress Foundation WordPress≤ 6.0 ≤6.0.7enisa_euvdEU
WordPress Foundation WordPress≤ 6.4 ≤6.4.3enisa_euvdEU
WordPress Foundation WordPress≤ 6.3 ≤6.3.3enisa_euvdEU
WordPress Foundation WordPress≤ 6.1 ≤6.1.5enisa_euvdEU
WordPress Foundation WordPress≤ 6.5 ≤6.5.1enisa_euvdEU
WordPress Foundation WordPress≤ 6.2 ≤6.2.4enisa_euvdEU
WordPress Foundation WordPress≤ 6.5.1fstec_bduRU
WordPress Foundation WordPress≤ 6.5.0fstec_bduRU
WordPress Foundation WordPress6.0.0 → 6.0.7fstec_bduRU

20 von 42 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2024-1060WordPress: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2024-05-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in WordPress ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
BIT-wordpress-2024-44392024-05-14vendor · osvUS
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
BIT-wordpress-multisite-2024-44392024-05-14vendor · osvUS
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

veröffentlicht 2024-05-03geändert 2026-06-17

Referenzen (17)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan