CVE-2024-4439: WordPress Core Avatar Block Stored XSS via Display Name

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable, has a public exploit reference, and a very high EPSS score despite a medium CVSS rating.

What it is

WordPress Core fails to escape user display names in the Avatar block, allowing stored cross-site scripting in versions up to 6.5.2. Authenticated contributors and above can inject scripts, and unauthenticated attackers can inject via the comment block when it displays the comment author's avatar. The flaw matters because injected scripts execute for any visitor viewing the affected page.

Impact

An attacker can execute arbitrary JavaScript in the context of a victim's browser session, enabling session theft, credential harvesting, or actions performed as the victim.

Attack surface

Reachable over the network through the Avatar block and comment block; contributor-level authentication is needed for the display-name path, while the comment-block path requires no authentication but depends on the block being present. The CVSS vector shows no privileges required and user interaction required, consistent with a victim needing to view the injected page.

Exploitation

Not listed in CISA KEV, but EPSS is 0.71024 (99.372 percentile), indicating high predicted exploitation activity, and a third-party advisory is tagged Exploit.

What to do

• Update WordPress Core to 6.5.2 or later, which contains the patch referenced in the changesets.
• If immediate patching is not possible, restrict contributor-level accounts and review display names for suspicious content.
• Disable or remove the Avatar block and comment block avatar display where not needed.
• Apply a web application firewall rule to block script payloads in display names and comment author fields.
• Audit existing user display names and comments for injected script content and clean any found.

Detection

• Search user display names and comment author fields for script tags or event handler attributes.
• Monitor web server and application logs for requests containing script payloads in profile or comment submission parameters.
• Inspect rendered pages containing the Avatar block for unexpected inline scripts or DOM changes.
• Review WordPress audit logs for contributor-level profile updates followed by anomalous page content changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.