Risk Letters

Exploited vulnerability

CVE-2024-2347

TLP:CLEAR

brainstormforce astra Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Facts

  • Vendor: brainstormforce
  • Product: astra
  • EPSS (probability of exploitation within 30 days): 0.4 %
  • First known exploitation: 13 October 2026
  • First seen by Risk Letters: 13 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD