The vulnerability of the “Avatar” module in the WordPress content management system allows a hacker to gain access to read, modify, or delete data, thereby executing XSS attacks.

WordPress Avatar vulnerability lets attackers read, modify, delete data and perform XSS via author.

Reporter	Title	Published	Views	Family All 32
GithubExploit	Exploit for CVE-2024-4439	6 May 202409:07	–	githubexploit
GithubExploit	Exploit for CVE-2024-4439	10 Oct 202409:30	–	githubexploit
GithubExploit	Exploit for CVE-2024-4439	21 Nov 202413:36	–	githubexploit
Circl	CVE-2024-4439	6 May 202408:54	–	circl
CNNVD	WordPress 跨站脚本漏洞	3 May 202400:00	–	cnnvd
CVE	CVE-2024-4439	3 May 202405:32	–	cve
Cvelist	CVE-2024-4439	3 May 202405:32	–	cvelist
Debian	[SECURITY] [DSA 6075-1] wordpress security update	9 Dec 202523:42	–	debian
Debian CVE	CVE-2024-4439	3 May 202405:32	–	debiancve
Tenable Nessus	Debian dsa-6075 : wordpress - security update	9 Dec 202500:00	–	nessus

Vulners

Node

wordpress wordpressRange6.4.0–6.4.3

wordpress wordpressRange6.3.0–6.3.3

wordpress wordpressRange6.2.0–6.2.4

wordpress wordpressRange6.1.0–6.1.5

wordpress wordpressRange6.0.0–6.0.7

Source	Link
core	www.core.trac.wordpress.org/changeset/57951/branches/6.4/src/wp-includes/blocks/avatar.php
core	www.core.trac.wordpress.org/changeset
wordpress	www.wordpress.org/news/2024/04/wordpress-6-5-2-maintenance-and-security-release/
wordfence	www.wordfence.com/blog/2024/04/unauthenticated-stored-cross-site-scripting-vulnerability-patched-in-wordpress-core/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e363c09a-4381-4b3a-951c-9a0ff5669016
github	www.github.com/d0rb/CVE-2024-4439
wordpress	www.wordpress.org/documentation/article/avatar-block/
web	www.web.nvd.nist.gov/view/vuln/detail

15 May 2024 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 26.4

CVSS 37.2

EPSS0.70822