CVE-2024-38739 MEDIUM

CVE-2024-38739: WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerability

Vendor Famethemes

Product OnePress

Weakness CWE-79 · XSS

Published July 20, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in FameThemes OnePress allows Stored XSS.This issue affects OnePress: from n/a through 2.3.8.

Explanation of Vulnerability in Simple Terms

02Summary

OnePress versions up to 2.3.8 contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. The vulnerability requires high-level privileges and user interaction to exploit. An attacker with admin access can craft a malicious request that, when clicked by another admin, executes arbitrary JavaScript in their browser session.

What an attacker can do

03Attacker Capabilities

Inject malicious JavaScript that runs in another admin's browser and steals their session or data.

Potential impact on your site

04Site Impact

An admin account could be compromised if tricked into clicking a malicious link, potentially allowing unauthorized changes to site content or settings.

Conditions required to exploit

05Prerequisites

Attacker must have admin-level access to OnePress and trick another admin into clicking a crafted link.

Key dates

06Disclosure timeline

July 20, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-38739 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities