{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2024-4439",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2024-4439",
    "idYear": 2024,
    "status": "PUBLISHED",
    "publishedAt": "2024-05-03T05:32:34.988Z",
    "updatedAt": "2024-08-01T20:40:47.361Z",
    "importedAt": "2026-10-24T01:57:20.494Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": null,
      "summary": "WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.",
      "affected": [
        {
          "vendor": "WordPress Foundation",
          "product": "WordPress",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "6.0",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.7"
            },
            {
              "version": "6.1",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.5"
            },
            {
              "version": "6.2",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.4"
            },
            {
              "version": "6.3",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "6.3.3"
            },
            {
              "version": "6.4",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.3"
            },
            {
              "version": "6.5",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "6.5.1"
            }
          ]
        }
      ]
    }
  }
}