CVE-2022-4973 MEDIUM

CVE-2022-4973: WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function

Vendor Wordpress Foundation
Product WordPress
Weakness CWE-79 · XSS
Published October 16, 2024
Last update April 8, 2026

CVSS base score

4.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.

Key dates

02Disclosure timeline

October 16, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE