CVE-2022-21662
Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 64.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 64.53% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- wordpress/wordpress · debian/debian linux
- Source
- security-advisories@github.com
References
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889wThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00019.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/
- https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/Release Notes, Vendor Advisory
- https://www.debian.org/security/2022/dsa-5039Third Party Advisory
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889wThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00019.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/
- https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/Release Notes, Vendor Advisory
- https://www.debian.org/security/2022/dsa-5039Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.