Description:

CVE-2024-4439 is a Stored Cross-Site Scripting (XSS) vulnerability in WordPress Core, allowing authenticated attackers with contributor-level access or above to inject malicious scripts into pages. Unauthenticated attackers can also exploit this vulnerability if the comment block is present and displays the comment author's avatar.

Key Insights:

• High Severity: The SVRS of 62 indicates a moderate level of severity, highlighting the need for prompt attention.
• Active Exploitation: Active exploits have been published, indicating that attackers are actively exploiting this vulnerability.
• Wide Impact: The vulnerability affects various versions of WordPress Core up to 6.5.2, potentially impacting a large number of websites.
• Threat Actors: Specific threat actors or APT groups exploiting this vulnerability are not currently identified.

Mitigation Strategies:

• Update WordPress: Install the latest WordPress version (6.5.3) to patch the vulnerability.
• Disable Comment Block: If the comment block is not essential, disable it to prevent unauthenticated attackers from exploiting the vulnerability.
• Restrict User Permissions: Limit user permissions to the minimum necessary to reduce the risk of authenticated attackers exploiting the vulnerability.
• Implement Web Application Firewall (WAF): Configure a WAF to block malicious requests and protect against XSS attacks.

Additional Information:

• The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• Users with additional queries can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information.