CVE-2024-38739 is a stored cross-site scripting vulnerability (CWE-79) in FameThemes OnePress theme versions up to 2.3.8. It results from improper input sanitization during web page generation, enabling an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of the affected site. The vulnerability has a CVSS 3.1 base score of 5.1, indicating medium severity with limited impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the report date.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute when other users view the affected pages, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and high privileges, which reduces the overall risk. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit high privilege user access and exercise caution with user-generated content. Monitor vendor channels for updates regarding patches or official mitigations.