CVE-2024-5892: 
WordPress vulnerability analysis and mitigation

The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-5892) in versions up to and including 3.6.6. The vulnerability exists in the 'support_unfiltered_files_upload' function due to insufficient input sanitization and output escaping (Wordfence).

The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue stems from improper input sanitization and output escaping in the 'support_unfiltered_files_upload' function, which allows for the injection of malicious scripts (NVD).

When exploited, this vulnerability allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (Wordfence).

The vulnerability requires an authenticated user with Author-level privileges or higher to exploit. The attack complexity is considered low, and no user interaction is required for the exploit to succeed (NVD).

Users are advised to update to version 4.0.0 or later of the Divi Torque Lite plugin, which contains patches for this vulnerability (WordPress).