CVE-2024-1767 is a stored cross-site scripting vulnerability in the Blocksy WordPress theme (creativethemeshq) affecting all versions up to and including 2.0.26. The issue arises from insufficient input sanitization and output escaping on user-controllable attributes like 'className' and 'radius' within the theme's blocks. This allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4, reflecting a medium severity level. There is no indication of known exploits in the wild or an official patch available at this time.

An attacker with contributor-level or higher permissions can inject malicious scripts into pages via vulnerable attributes, potentially leading to session hijacking, defacement, or other script-based attacks when other users access the injected content. The impact affects confidentiality and integrity but does not affect availability. The vulnerability requires authenticated access and user interaction to trigger the malicious script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit contributor-level access to trusted users only and consider disabling or restricting use of the vulnerable blocks. Monitor vendor channels for updates and apply patches promptly once released.