CVE-2024-6339 is a reflected cross-site scripting vulnerability in the averta Phlox PRO WordPress theme affecting all versions up to and including 5.16.4. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of search parameters. This allows unauthenticated attackers to inject and execute arbitrary web scripts in the context of the victim's browser when the victim clicks a crafted link. The vulnerability has a CVSS 3.1 base score of 6.1, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. Exploitation requires user interaction and no authentication, increasing the risk to end users of affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or replacing the Phlox PRO theme or applying custom input sanitization and output escaping for search parameters. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor official averta or WordPress security advisories for updates regarding a fix.