CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
What the vulnerability does
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Explanation of Vulnerability in Simple Terms
WordPress 5.4.0 contains a cross-site scripting vulnerability in the block editor that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction—the victim must view a specially crafted block. An attacker with low privileges can read sensitive data from the affected user's browser session, but cannot modify site content or availability.
What an attacker can do
Read sensitive data from an authenticated user's browser session via injected scripts.
Potential impact on your site
Authenticated users viewing untrusted block content risk session hijacking or credential theft.
Conditions required to exploit
Attacker needs a low-privilege WordPress account; victim must view a malicious block in the editor.
Key dates
External resources
Related vulnerabilities
