CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
What the vulnerability does
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
Explanation of Vulnerability in Simple Terms
WordPress versions before 5.3.1 contain a cross-site scripting vulnerability in the block editor. An attacker with low-level user access can inject malicious scripts that execute in other users' browsers when they view or edit affected content. The vulnerability requires the victim to interact with a specially crafted block or page. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
What an attacker can do
Inject JavaScript that runs in other users' browsers, potentially stealing sessions or performing actions as those users.
Potential impact on your site
Users with low-privilege accounts can compromise higher-privilege users' sessions or perform unauthorized actions on the site.
Conditions required to exploit
Attacker needs a low-privilege WordPress account (contributor or higher). Victim must view or interact with the malicious content.
Key dates
External resources
Related vulnerabilities
