PT-2019-5214 · WordPress · Wordpress

CVE-2019-16780

·

Publicado

2019-09-11

·

Atualizado

2022-11-23

CVSS v3.1

5.8

Média

VetorAV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions WordPress versions 3.7 through 5.3
Description The issue is related to a cross-site scripting (XSS) error in the block editor of the WordPress content management system. This error can be exploited by authorized users using a specific payload, allowing a remote attacker to compromise data integrity. The exploitation requires an authenticated user and can lead to XSS attacks if an administrator opens the affected post in the editor.
Recommendations For WordPress versions 3.7 through 5.3, update to version 5.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the block editor for lower-privileged users, such as contributors, until the update is applied.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2020-01943
CVE-2019-16780
DSA-4599-1
DSA-4677-1
GHSA-X3WP-H3QX-9W94

Produtos afetados

Wordpress