CVE-2024-37199: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the Kriesi.At Enfold WordPress theme, affecting versions up to and including 5.6.9. The vulnerability was publicly disclosed on June 20, 2024, and was assigned CVE-2024-37199. This security issue stems from insufficient input sanitization and output escaping in the theme's functionality (WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received varying CVSS v3.1 severity scores. The National Vulnerability Database (NVD) assigned a base score of 6.1 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack rated it at 7.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD, Patchstack).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute when users perform specific actions, such as clicking on a malicious link. This could enable attackers to inject malicious scripts, redirects, advertisements, and other HTML payloads into the website that would be executed when guests visit the site (Patchstack).

The vulnerability has been patched in version 5.6.10 of the Enfold theme. Users are advised to update to version 5.6.10 or later to remove the vulnerability (Patchstack).