CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
What the vulnerability does
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Explanation of Vulnerability in Simple Terms
WordPress 5.4.0 contains a stored cross-site scripting (XSS) vulnerability in the block editor. An authenticated user with low privileges can inject malicious scripts into block content that execute in the browsers of other users, including administrators, when they view or edit the affected post. The vulnerability requires user interaction and affects the confidentiality of site data.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they view or edit posts.
Potential impact on your site
Attackers with contributor+ access can steal admin session tokens, modify site content, or perform actions as higher-privileged users.
Conditions required to exploit
Attacker must have low-level WordPress account (e.g., contributor or author); victim must view or edit the affected post.
Key dates
External resources
Related vulnerabilities
