CVE-2024-5439 is a reflected cross-site scripting vulnerability in the Blocksy WordPress theme (creativethemeshq) affecting all versions up to and including 2.0.50. The issue arises from improper input validation (CWE-20) of the custom_url parameter, which allows injection of arbitrary web scripts that execute when a user interacts with a maliciously crafted link. The vulnerability requires no user interaction beyond clicking a link and does not require privileges to exploit. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with scope changed.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure or manipulation of web content. The vulnerability impacts confidentiality and integrity but does not affect availability. Since the attacker is unauthenticated and the attack vector is network-based, this vulnerability could be leveraged in phishing or social engineering attacks. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or replacing the Blocksy theme if feasible, or apply any recommended temporary mitigations from the vendor. Monitoring for updates from creativethemeshq is advised to apply an official fix once available.