CVE-2024-4439

HIGH NUCLEI LAB

WordPress 6.0-6.5.2 - Stored Cross-Site Scripting via Avatar Block Display Name

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 5 public exploits for CVE-2024-4439. PoCs published by d0rb, MielPopsssssss, w0r1i0g1ht. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains a functional exploit for CVE-2024-4439, demonstrating an unauthenticated stored XSS vulnerability in WordPress Core via the Avatar block. The PoC injects a reverse shell payload by exploiting insufficient output escaping of user display names.

Description

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

Exploits (5)

nomisec WORKING POC 10 stars
by d0rb · poc
https://github.com/d0rb/CVE-2024-4439

The repository contains a functional exploit for CVE-2024-4439, demonstrating an unauthenticated stored XSS vulnerability in WordPress Core via the Avatar block. The PoC injects a reverse shell payload by exploiting insufficient output escaping of user display names.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: WordPress Core up to 6.5.1
No auth needed
Prerequisites: Target running vulnerable WordPress version · Access to the target's wp-admin/admin-ajax.php endpoint
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC 2 stars
by MielPopsssssss · poc
https://github.com/MielPopsssssss/CVE-2024-4439

This repository contains a functional Python script that demonstrates a stored XSS vulnerability in WordPress (CVE-2024-4439). The PoC exploits two endpoints: `/wp-comments-post.php` and `/wp-admin/profile.php` by injecting malicious payloads into user-controlled fields.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WordPress (version not specified)
Auth required
Prerequisites: Access to WordPress comment submission or profile update functionality
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by w0r1i0g1ht · poc
https://github.com/w0r1i0g1ht/CVE-2024-4439

This repository provides a detailed walkthrough for exploiting CVE-2024-4439, a stored XSS vulnerability in WordPress. It includes setup instructions for a Docker-based test environment and step-by-step guidance on triggering the XSS via comment injection.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: WordPress 6.4.3
Auth required
Prerequisites: WordPress instance with theme customization access · Ability to post comments
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by soltanali0 · poc
https://github.com/soltanali0/CVE-2024-4439

The repository contains a functional Python exploit for CVE-2024-4439, targeting WordPress via XSS and reverse shell injection. It leverages comment and profile update endpoints to deliver payloads.

Classification
Working Poc 95%
Attack Type
Xss | Rce
Complexity
Moderate
Reliability
Reliable
Target: WordPress (version not specified)
No auth needed
Prerequisites: Target WordPress site with vulnerable endpoints · Attacker-controlled server for reverse shell
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by xssor-dz · poc
https://github.com/xssor-dz/-CVE-2024-4439

This PoC demonstrates a stored XSS vulnerability in WordPress (CVE-2024-4439) by injecting malicious payloads into comment and profile fields. It sends crafted POST requests to /wp-comments-post.php and /wp-admin/profile.php, triggering XSS when the payloads are rendered.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WordPress (version not specified)
Auth required
Prerequisites: Target WordPress site URL · Valid session for profile update
devstral-2 · analyzed Feb 19, 2026 Full analysis →

Nuclei Templates (1)

WordPress Core <6.5.2 - Cross-Site Scripting
HIGHby nqdung2002

Scores

CVSS v3 7.2
EPSS 0.7082
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-80
Status published
Products (1)
wordpress/wordpress 6.0 - 6.0.7
Published May 03, 2024
Tracked Since Feb 18, 2026