What the vulnerability does
01Description
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)
Explanation of Vulnerability in Simple Terms
02Summary
WordPress versions 5.0 through 5.7.2 contain a stored cross-site scripting (XSS) vulnerability in the block editor. An authenticated user with low privileges can inject malicious JavaScript into block content. When another user views or edits the affected post, the script executes in their browser with their permissions. The vulnerability requires user interaction (viewing the post) and affects the confidentiality and integrity of site data.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in other users' browsers when they view or edit posts.
Potential impact on your site
04Site Impact
Attackers with contributor+ access can steal admin session tokens, modify site content, or perform actions as higher-privilege users.
Conditions required to exploit
05Prerequisites
Attacker needs a low-privilege WordPress account (e.g., contributor or author) and the victim must view or edit the affected post.
Key dates
06Disclosure timeline
September 9, 2021
CVE published
August 4, 2024
Record updated
