Stored cross-site scripting in WordPress - CVE-2022-21662
Published: January 7, 2022 / Updated: January 11, 2022
Vulnerability identifier: #VU59288
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2022-21662
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in post slugs. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
WordPress
wordpress (Debian package)
wordpress
Fedora
wordpress (Debian package)
wordpress
Fedora
How to mitigate CVE-2022-21662
Install updates from vendor's website.
WordPress - addressed in versions 3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3
wordpress (Debian package) - addressed in versions 5.0.15+dfsg1-0+deb10u1, 5.7.5+dfsg1-0+deb11u1
wordpress - addressed in versions 5.1.12-1.el7, 5.8.3-1.fc34, 5.8.3-1.fc35
wordpress (Debian package) - addressed in versions 5.0.15+dfsg1-0+deb10u1, 5.7.5+dfsg1-0+deb11u1
wordpress - addressed in versions 5.1.12-1.el7, 5.8.3-1.fc34, 5.8.3-1.fc35