CVE-2024-34766: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress ChaosTheory theme, affecting versions up to and including 1.3. The vulnerability was discovered by Rafie Muhammad and was publicly disclosed on May 17, 2024, with CVE identifier CVE-2024-34766. The issue has been fixed in version 1.3.2 (WPScan, Patchstack).

The vulnerability stems from insufficient input sanitization and output escaping in the ChaosTheory theme. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The weakness is categorized as CWE-79: Improper Neutralization of Input During Web Page Generation (Patchstack).

The vulnerability allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an injected page, potentially leading to unauthorized actions, data theft, or site defacement (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack complexity is considered low, requiring user interaction for successful exploitation (Patchstack).

Website administrators are advised to update the ChaosTheory theme to version 1.3.2 or later to resolve the vulnerability. For those unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).