xssor-dz/-CVE-2024-4439

PoC

WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block

view exploit source poc_in_githubauthor xssor-dzpublished 2024-05-20catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2024-4439US	medium6.1	71.0% (99th)	Exploit	2024-05-03
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the di…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.