CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.
Explanation of Vulnerability in Simple Terms
WordPress 6.3 and 6.3.1 contain a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. When a victim with higher privileges views the affected content, the script executes in their browser, potentially compromising their account or the site. The vulnerability requires user interaction and affects the site's integrity and confidentiality.
What an attacker can do
Inject malicious scripts that execute when other users view the affected content, potentially stealing credentials or session tokens.
Potential impact on your site
Authenticated users can inject persistent scripts affecting other users; admin accounts viewing compromised content are at highest risk.
Conditions required to exploit
Attacker must have a low-privilege WordPress account and the victim must view the page containing the injected script.
Key dates
External resources
Related vulnerabilities
