What the vulnerability does
01Description
In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Explanation of Vulnerability in Simple Terms
02Summary
WordPress 5.4.0 contains a cross-site scripting vulnerability in the block editor that allows an authenticated attacker to inject malicious scripts. The attacker must trick a site editor or administrator into visiting a crafted page or clicking a malicious link. Successful exploitation can compromise the confidentiality and integrity of site data and user sessions.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that execute in the browser of editors or administrators viewing the block editor.
Potential impact on your site
04Site Impact
Editors and administrators could have their sessions hijacked or site content modified without their knowledge.
Conditions required to exploit
05Prerequisites
Attacker needs a WordPress user account with low privileges; victim must visit a crafted page or click a link.
Key dates
06Disclosure timeline
April 30, 2020
CVE published
August 4, 2024
Record updated
