CVE-2024-33955
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Freesia Empire allows Stored XSS.This issue affects Freesia Empire: from n/a through 1.4.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS vulnerability in WordPress Freesia Empire theme up to version 1.4.1 allows attackers to inject malicious scripts into web pages.
The Freesia Empire WordPress theme, versions up to and including 1.4.1, contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This allows attackers to inject arbitrary scripts into vulnerable pages.
Exploitation requires a user with at least contributor-level privileges to inject the malicious payload [1]. The injected script then executes whenever any visitor accesses the affected page, potentially compromising the site's visitors.
An attacker can use this to perform actions such as redirecting users to malicious sites, displaying unwanted advertisements, or stealing sensitive information [1]. The CVSS v3.1 base score is 6.5, indicating a medium severity.
The vulnerability has been patched in version 1.4.2 of the theme [1]. Users are strongly advised to update to the latest version to mitigate the risk.
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.