PT-2019-5214 · WordPress · Wordpress

Published 2019-09-11 · Updated 2022-11-23 · CVE-2019-16780

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions 3.7 through 5.3

Description The issue is related to a cross-site scripting (XSS) error in the block editor of the WordPress content management system. This error can be exploited by authorized users using a specific payload, allowing a remote attacker to compromise data integrity. The exploitation requires an authenticated user and can lead to XSS attacks if an administrator opens the affected post in the editor.

Recommendations For WordPress versions 3.7 through 5.3, update to version 5.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the block editor for lower-privileged users, such as contributors, until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-01943

CVE-2019-16780

DSA-4599-1

DSA-4677-1

GHSA-X3WP-H3QX-9W94

Affected Products

Wordpress

References · 19

• https://github.com/WordPress/wordpress-develop/commit/505dd6a20b6fc3d06130018c1caeff764248c29e · Patch
• https://osv.dev/vulnerability/DSA-4599-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16780 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16780 · Vendor Advisory
• https://debian.org/security/2020/dsa-4677 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-16780 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-16780 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4677-1 · Vendor Advisory
• https://debian.org/security/2020/dsa-4599 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-16780 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-16780 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-16780 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01943 · Security Note
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x3wp-h3qx-9w94 · Note
• https://seclists.org/bugtraq/2020/Jan/8 · Note