The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’…

CVE-2024-5646 is a stored XSS bug in the Futurio Extra WordPress plugin's Advanced Text Block widget. Affected versions are up to and including 2.0.5, and the fix landed in 2.0.6. The vulnerable path is the header_size attribute; an authenticated user with at least Contributor privileges can store crafted script-bearing content that later executes when the poisoned page is rendered.

The vendor's 6.4 / MEDIUM score overstates operational urgency for most enterprises. The decisive friction is that this is not unauthenticated remote, and in practice it also needs a victim page view to cash out the XSS, which lines up better with NVD's UI:R 5.4 interpretation than the CNA's UI:N 6.4. For a 10,000-host patch queue, this belongs behind pre-auth and actively exploited web flaws.

Why this verdict

• Post-auth only: the attacker needs a valid WordPress account with at least Contributor privileges, which is a material downgrade from any unauthenticated internet-facing flaw.
• Victim view required in practice: despite the CNA's UI:N vector, stored XSS still needs someone to render the compromised page; that makes NVD's UI:R interpretation closer to real operational risk.
• Narrow blast radius: successful exploitation compromises one WordPress site context, not the broader host fleet, and usually only after editorial workflow conditions line up.

Why not higher?

There is no KEV listing, no active exploitation evidence in the reviewed sources, and no unauthenticated path. The attack chain compounds friction at every stage: plugin presence, vulnerable version, valid Contributor credentials, use of the affected widget path, and a victim page render.

Why not lower?

This is still a stored XSS, not a cosmetic bug. If the site uses contributor workflows heavily and an admin/editor regularly previews or edits affected pages, the bug can become a credible privilege-pivot inside that specific WordPress tenant.

1. Restrict Contributor logins — If you cannot patch immediately in your normal maintenance flow, reduce the reachable population by trimming unused Contributor/Author accounts, enforcing SSO/MFA, and disabling direct local logins where possible. For a LOW verdict there is no SLA; treat this as backlog hygiene and complete it during routine identity cleanup.
2. Review pages using Futurio widgets — Search published and draft content for pages built with the Futurio Extra Advanced Text Block widget and spot-check suspicious custom values or unexpected script-bearing markup. This is a targeted way to cut risk while you wait for the normal plugin update cycle; for LOW, do it in the next content-security review window.
3. Apply WordPress WAF rules — Use WordPress-aware WAF coverage or plugin-security tooling that can block common XSS payload patterns and flag suspicious post edits. This is not a substitute for upgrading, but it lowers exploit reliability while the issue sits in the backlog.
4. Upgrade to 2.0.6 or later — Move affected sites off <= 2.0.5 during your next planned WordPress/plugin patch cycle. For a LOW verdict, this is routine remediation rather than an outage-worthy emergency change.

Run this on the WordPress host with read access to the site's filesystem. Invoke it as bash check_futurio_extra_cve_2024_5646.sh /var/www/html or point it directly at the plugin directory; no root is required if you can read wp-content/plugins/futurio-extra.

#!/usr/bin/env bash
# check_futurio_extra_cve_2024_5646.sh
# Detects whether Futurio Extra is vulnerable to CVE-2024-5646.
# Usage: bash check_futurio_extra_cve_2024_5646.sh /path/to/wordpress_or_plugin_dir
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN: missing argument. Usage: $0 /path/to/wordpress_or_plugin_dir"
  exit 2
fi

PLUGIN_DIR=""
if [[ -d "$TARGET/wp-content/plugins/futurio-extra" ]]; then
  PLUGIN_DIR="$TARGET/wp-content/plugins/futurio-extra"
elif [[ -d "$TARGET/futurio-extra" ]]; then
  PLUGIN_DIR="$TARGET/futurio-extra"
elif [[ -d "$TARGET" && -f "$TARGET/futurio-extra.php" ]]; then
  PLUGIN_DIR="$TARGET"
else
  echo "UNKNOWN: Futurio Extra plugin directory not found under target '$TARGET'"
  exit 2
fi

MAIN_FILE="$PLUGIN_DIR/futurio-extra.php"
README_FILE="$PLUGIN_DIR/readme.txt"
VERSION=""

if [[ -f "$MAIN_FILE" ]]; then
  VERSION=$(awk -F': ' 'BEGIN{IGNORECASE=1} /^Version:[[:space:]]*/ {gsub(/\r/, "", $2); print $2; exit}' "$MAIN_FILE")
fi

if [[ -z "$VERSION" && -f "$README_FILE" ]]; then
  VERSION=$(awk -F': ' 'BEGIN{IGNORECASE=1} /^Stable tag:[[:space:]]*/ {gsub(/\r/, "", $2); print $2; exit}' "$README_FILE")
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: could not determine Futurio Extra version from $PLUGIN_DIR"
  exit 2
fi

verlte() {
  # returns success if $1 <= $2 using sort -V
  [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" == "$1" ]]
}

if verlte "$VERSION" "2.0.5"; then
  echo "VULNERABLE: Futurio Extra version $VERSION detected at $PLUGIN_DIR (affected: <= 2.0.5)"
  exit 1
fi

if [[ -d "$PLUGIN_DIR" ]]; then
  echo "PATCHED: Futurio Extra version $VERSION detected at $PLUGIN_DIR (fixed: >= 2.0.6)"
  exit 0
fi

echo "UNKNOWN: unexpected state while checking $PLUGIN_DIR"
exit 2

Sources

1. Wordfence vulnerability entry for CVE-2024-5646
2. WordPress.org plugin page and changelog
3. OpenCVE record with CNA, NVD, and references
4. CISA Known Exploited Vulnerabilities catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. Wordfence weekly report noting real-time firewall coverage
8. OSV record showing NVD-enriched 5.4/UI:R scoring