What the vulnerability does
01Description
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
Explanation of Vulnerability in Simple Terms
02Summary
WordPress 5.4.0 and 5.4.1 contain a cross-site scripting (XSS) vulnerability in the block editor. An authenticated user with low privileges can inject malicious scripts into block content. When another user views or edits the affected content, the script executes in their browser with their permissions. The impact extends beyond the vulnerable component due to scope change.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that execute when other users view or edit block content.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other users' sessions and site functionality.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account and the victim must view or edit the affected content.
Key dates
06Disclosure timeline
June 12, 2020
CVE published
August 4, 2024
Record updated
