What the vulnerability does
01Description
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
Explanation of Vulnerability in Simple Terms
02Summary
WordPress 5.4.0 and 5.4.1 contain a stored cross-site scripting (XSS) vulnerability in the block editor. An authenticated user with high privileges can inject malicious scripts into block content that execute when other users view the page. The vulnerability requires user interaction to trigger and does not affect confidentiality or availability.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts into block editor content that execute in other users' browsers.
Potential impact on your site
04Site Impact
A compromised high-privilege account can inject scripts affecting other users' sessions, but data theft and site takeover are not directly possible.
Conditions required to exploit
05Prerequisites
Attacker must have high-level WordPress privileges (e.g., editor or administrator) and the victim must view the affected page.
Key dates
06Disclosure timeline
June 12, 2020
CVE published
August 4, 2024
Record updated
