CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
What the vulnerability does
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.
Explanation of Vulnerability in Simple Terms
WordPress 5.8 beta 1 contains a stored cross-site scripting (XSS) vulnerability in the block editor. An authenticated user with low privileges can inject malicious scripts into block content that execute in the browsers of other users, including administrators. The vulnerability requires user interaction—victims must view the affected block—but can compromise site security and user data.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view affected content.
Potential impact on your site
Attackers with contributor or author access can steal admin credentials, modify site content, or compromise visitor data.
Conditions required to exploit
Attacker must have a low-privilege WordPress account and the victim must view the page containing the malicious block.
Key dates
External resources
Related vulnerabilities
