CVE-2024-5061 is a stored cross-site scripting vulnerability in the Enfold - Responsive Multi-Purpose Theme for WordPress. It affects all versions up to 6.0.3 due to improper neutralization of input in the 'wrapper_class' and 'class' parameters. Authenticated attackers with contributor or higher privileges can inject malicious scripts that execute in the context of users viewing the compromised pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

An attacker with contributor-level or higher access can inject and store malicious scripts via vulnerable parameters, which execute when other users access the affected pages. This can lead to partial compromise of user confidentiality and integrity, such as session hijacking or unauthorized actions performed in the context of the victim user. There is no direct impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only and consider additional input validation or output escaping controls if possible. Monitor official Kriesi or WordPress theme update channels for patches addressing this vulnerability.