CVE-2024-44010 describes a stored cross-site scripting vulnerability in the catchthemes Full frame theme for WordPress, present in versions up to 2.7.2. The vulnerability is due to improper input neutralization during web page generation, which allows attackers with high privileges to inject malicious scripts that are stored and later executed in the context of other users. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, privileges, and user interaction, with limited impact on confidentiality, integrity, and availability. No patch or vendor advisory information is currently available.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality, integrity, and availability impacts, such as session hijacking or content manipulation. However, exploitation requires user interaction and high privileges, reducing the overall risk. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to trusted users only and consider applying web application firewall (WAF) rules to detect and block potential XSS payloads related to this theme. Monitor vendor channels for updates and patches.