CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Explanation of Vulnerability in Simple Terms
WordPress versions 5.9 through 5.9.9 contain a vulnerability that allows authenticated users with low privileges to read sensitive information and modify content across the site. The vulnerability affects multiple components due to scope change, meaning the impact extends beyond a single isolated function. Site administrators should update to a version newer than 5.9.9 immediately.
What an attacker can do
Read sensitive data and modify site content with a low-privilege user account.
Potential impact on your site
Unauthorized users can access private data and alter published content without admin approval.
Conditions required to exploit
Attacker must have a valid low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
