Authenticated XSS via media attachment page in WordPress
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.4.2, 5.3.4, 5.2.7, 5.1.6, 5.0.10, and 13 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
Timeline
- CVE published
- Record last updated
Affected versions
- WordPress wordpress-develop
From 5.4.0 · fixed in 5.4.2; From 5.3.0 · fixed in 5.3.4; From 5.2.0 · fixed in 5.2.7; From 5.1.0 · fixed in 5.1.6; From 5.0.0 · fixed in 5.0.10; From 4.9.0 · fixed in 4.9.15; From 4.8.0 · fixed in 4.8.14; From 4.7.0 · fixed in 4.7.18; From 4.6.0 · fixed in 4.6.19; From 4.5.0 · fixed in 4.5.22; From 4.4.0 · fixed in 4.4.23; From 4.3.0 · fixed in 4.3.24; From 4.2.0 · fixed in 4.2.28; From 4.1.0 · fixed in 4.1.31; From 4.0.0 · fixed in 4.0.31; From 3.9.0 · fixed in 3.9.32; From 3.8.0 · fixed in 3.8.34; From 3.7.0 · fixed in 3.7.34