CVE-2024-5533: 
WordPress vulnerability analysis and mitigation

The Divi theme for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-5533) affecting all versions up to and including 4.25.1. The vulnerability was discovered and disclosed by Ngô Thiên An (ancorn_), and was patched in version 4.25.2 (Wordfence Advisory, NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the Divi theme. This security flaw allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. The injected scripts execute whenever a user accesses the affected page. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NVD and 6.4 (Medium) by Wordfence, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

If exploited, this vulnerability allows attackers to inject malicious JavaScript code that executes in users' browsers when they visit the compromised pages. This could lead to various attacks including cookie theft, session hijacking, or other client-side attacks targeting site visitors (WPScan).

The vulnerability requires an authenticated user with at least Author-level privileges to exploit. The attack vector is network-accessible (AV:N), requires low attack complexity (AC:L), and low privileges (PR:L). User interaction is required (UI:R) for the exploit to be successful (NVD).

The vulnerability has been patched in Divi version 4.25.2. Site administrators are strongly advised to update to this version or later to protect against this security issue. The fix addresses the input sanitization and output escaping mechanisms to prevent the injection of malicious scripts (Divi Changelog).