CVE-2024-4439

mediumpriority · attend · 59EPSS 0.710 · 99 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

5 exploits · PoC

Likely / severe?

71.0% (99th) EPSS

CVSS 6.1 · medium

Is it mine?

42 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-26

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

cvss

Technical severity, 0–10. One row per scoring source.

7.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.1–7.2

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7

v3.17.2highAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · security@wordfence.comexploitability 3.9 · impact 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-80US

exploits (5)

Public proof-of-concept and weaponised exploit code.

MielPopsssssss/CVE-2024-4439CVE-2024-4439 PoCPoC · poc_in_github
d0rb/CVE-2024-4439The provided exploit code leverages a stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-4439) in WordPress Core versions up to 6.5.1.PoC · poc_in_github
soltanali0/CVE-2024-4439aaPoC · poc_in_github
w0r1i0g1ht/CVE-2024-4439CVE-2024-4439 docker and pocPoC · poc_in_github
xssor-dz/-CVE-2024-4439WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar BlockPoC · poc_in_github

affected products (42)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Open Source WordPress <6.1.6all versionscert_bundDE
Open Source WordPress <6.2.5all versionscert_bundDE
Open Source WordPress <6.3.4all versionscert_bundDE
Open Source WordPress <6.4.4all versionscert_bundDE
Open Source WordPress <6.5.2all versionscert_bundDE
Open Source WordPress< 6.1.6cert_bundDE
Open Source WordPress< 6.2.5cert_bundDE
Open Source WordPress< 6.3.4cert_bundDE
Open Source WordPress< 6.4.4cert_bundDE
Open Source WordPress< 6.5.2cert_bundDE
WordPress Foundation WordPress≤ 6.0 ≤6.0.7enisa_euvdEU
WordPress Foundation WordPress≤ 6.4 ≤6.4.3enisa_euvdEU
WordPress Foundation WordPress≤ 6.3 ≤6.3.3enisa_euvdEU
WordPress Foundation WordPress≤ 6.1 ≤6.1.5enisa_euvdEU
WordPress Foundation WordPress≤ 6.5 ≤6.5.1enisa_euvdEU
WordPress Foundation WordPress≤ 6.2 ≤6.2.4enisa_euvdEU
WordPress Foundation WordPress≤ 6.5.1fstec_bduRU
WordPress Foundation WordPress≤ 6.5.0fstec_bduRU
WordPress Foundation WordPress6.0.0 → 6.0.7fstec_bduRU

showing 20 of 42

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1060WordPress: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2024-05-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in WordPress ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
BIT-wordpress-2024-44392024-05-14vendor · osvUS
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
BIT-wordpress-multisite-2024-44392024-05-14vendor · osvUS
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

published 2024-05-03modified 2026-06-17

references (17)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan