CVE-2024-4439
MediumWordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
Published May 6, 2024 · Updated Sep 21, 2026 · Also known as BIT-wordpress-2024-4439, BIT-wordpress-multisite-2024-4439, DEBIAN-CVE-2024-4439, UBUNTU-CVE-2024-4439, e363c09a-4381-4b3a-951c-9a0ff5669016
Key Facts
Patch immediately- CVE-2024-4439 is a medium-severity vulnerability (CVSS 6.1 v3.1) affecting WordPress, wordpress-multisite (bitnami).
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 71% probability of exploitation in the next 30 days.
- Fixed versions are available, including WordPress 6.0.8, WordPress 6.1.6, WordPress 6.1.9+dfsg1-0+deb12u1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
71%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2024-4439 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
Affected Products
20 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| WordPressWordpress | >= 6.0.0, >= 6.0 | 6.0.7 |
| wordpress-multisitebitnami | >= 6.0.0 | 6.0.8 |
Patched Releases
WordPress
6.0.8, 6.1.6, 6.1.9+dfsg1-0+deb12u1, 6.2.5, 6.3.4, 6.4.4, 6.5.2, 6.5.2+dfsg1-1, <=6.0.7
wordpress-multisite
6.0.8, 6.1.6, 6.2.5, 6.3.4, 6.4.4, 6.5.2
Timeline
Publicly disclosed
May 6, 2024
Last updated
Sep 21, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
References
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4439.json
- advisoryhttps://patchstack.com/database/vulnerability/ele-blog/wordpress-eleblog-elementor-blog-and-magazine-addons-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
- advisoryhttps://patchstack.com/database/vulnerability/exclusive-addons-for-elementor/wordpress-exclusive-addons-for-elementor-plugin-2-6-9-1-broken-access-control-on-post-duplication-vulnerability?_s_id=cve
- advisoryhttps://patchstack.com/database/vulnerability/ipanorama-360-virtual-tour-builder-lite/wordpress-ipanorama-360-plugin-1-8-1-broken-access-control-vulnerability?_s_id=cve
- advisoryhttps://patchstack.com/database/vulnerability/jw-player-7-for-wp/wordpress-jw-player-for-wordpress-plugin-2-3-3-broken-access-control-vulnerability?_s_id=cve
FAQ
Common Questions.
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name.
Affected: WordPress versions >= 6.0.0, >= 6.0; wordpress-multisite (bitnami) versions >= 6.0.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including WordPress 6.0.8, WordPress 6.1.6, WordPress 6.1.9+dfsg1-0+deb12u1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-4439 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo