CVE-2024-4439

See a problem?

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-4439

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4439.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-4439

Aliases

Related

UBUNTU-CVE-2024-4439

Published

2024-05-03T06:15:14Z

Modified

2024-10-02T21:45:26.699214Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

References

Affected packages

Debian:12 / wordpress

Package

Name: wordpress
Purl: pkg:deb/debian/wordpress?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.1.1+dfsg1-1

6.1.6+dfsg1-0+deb12u1

6.2+dfsg1-1

6.2.1+dfsg1-1

6.2.2+dfsg1-1

6.3+dfsg1-1

6.3.1+dfsg1-1

6.3.2+dfsg1-1

6.4.1+dfsg1-1

6.4.1+dfsg1-1.1

6.4.2+dfsg1-1

6.4.3+dfsg1-1

6.5+dfsg1-1

6.5.2+dfsg1-1

6.5.3+dfsg1-1

6.5.5+dfsg1-1

6.6.1+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / wordpress