CVE-2024-4334: 
WordPress vulnerability analysis and mitigation

The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress contains a DOM-Based Cross-Site Scripting vulnerability (CVE-2024-4334) discovered in versions up to and including 2.5.3. The vulnerability exists in the 'typing_cursor' parameter due to insufficient input sanitization and output escaping (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access and low privileges to exploit, requires no user interaction, has changed scope, and can impact both confidentiality and integrity with low severity (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack vector is through the 'typing_cursor' parameter, which lacks proper input sanitization and output escaping (NVD).