What the vulnerability does
01Description
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
Explanation of Vulnerability in Simple Terms
02Summary
WordPress core contains a stored cross-site scripting (XSS) vulnerability in how it handles user input. An authenticated attacker with low privileges can inject malicious scripts that execute in the browsers of other users, including administrators. The vulnerability requires user interaction to trigger. Affected versions are below 5.8.3.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers, potentially stealing credentials or performing actions as those users.
Potential impact on your site
04Site Impact
Attackers with contributor or subscriber accounts can compromise administrator sessions and take control of your WordPress site.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account and the victim must visit a page containing the injected payload.
Key dates
06Disclosure timeline
January 6, 2022
CVE published
April 23, 2025
Record updated
