PT-2021-4498 · WordPress · Wordpress

Lowe · Published 2021-09-09 · Updated 2024-01-31 · CVE-2021-39202

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions 5.8 beta 1 through 5.8

Description The issue is related to improper handling of HTML input in the Custom HTML feature of the widgets editor, introduced in WordPress 5.8 beta 1. This leads to stored XSS in the custom HTML widget. The vulnerability allows a remote attacker to inject arbitrary web or HTML code.

Recommendations For WordPress versions 5.8 beta 1 through 5.8, update to WordPress 5.8 or later to resolve the issue. As a temporary workaround, consider disabling the Custom HTML feature in the widgets editor until a patch is available. Restrict access to the custom HTML widget to minimize the risk of exploitation. Avoid using the Custom HTML feature in the widgets editor until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-05132

BIT-WORDPRESS-2021-39202

BIT-WORDPRESS-MULTISITE-2021-39202

CVE-2021-39202

GHSA-FR6H-3855-J297

Affected Products

Wordpress

References · 11

• https://osv.dev/vulnerability/BIT-wordpress-multisite-2021-39202 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39202 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-39202 · Security Note
• https://osv.dev/vulnerability/BIT-wordpress-2021-39202 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39202 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05132 · Security Note
• https://ubuntu.com/security/CVE-2021-39202 · Vendor Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fr6h-3855-j297 · Note
• https://hackerone.com/reports/1222797 · Note
• https://t.me/cibsecurity/28650 · Telegram Post