WordPress 6.0-6.5.2 - Stored Cross-Site Scripting via Avatar Block Display Name
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2024-4439. PoCs published by d0rb, MielPopsssssss, w0r1i0g1ht. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a functional exploit for CVE-2024-4439, demonstrating an unauthenticated stored XSS vulnerability in WordPress Core via the Avatar block. The PoC injects a reverse shell payload by exploiting insufficient output escaping of user display names.
Description
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
Exploits (5)
The repository contains a functional exploit for CVE-2024-4439, demonstrating an unauthenticated stored XSS vulnerability in WordPress Core via the Avatar block. The PoC injects a reverse shell payload by exploiting insufficient output escaping of user display names.
This repository contains a functional Python script that demonstrates a stored XSS vulnerability in WordPress (CVE-2024-4439). The PoC exploits two endpoints: `/wp-comments-post.php` and `/wp-admin/profile.php` by injecting malicious payloads into user-controlled fields.
This repository provides a detailed walkthrough for exploiting CVE-2024-4439, a stored XSS vulnerability in WordPress. It includes setup instructions for a Docker-based test environment and step-by-step guidance on triggering the XSS via comment injection.
The repository contains a functional Python exploit for CVE-2024-4439, targeting WordPress via XSS and reverse shell injection. It leverages comment and profile update endpoints to deliver payloads.
This PoC demonstrates a stored XSS vulnerability in WordPress (CVE-2024-4439) by injecting malicious payloads into comment and profile fields. It sends crafted POST requests to /wp-comments-post.php and /wp-admin/profile.php, triggering XSS when the payloads are rendered.
Nuclei Templates (1)
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N