PT-2022-15016 · WordPress · Wordpress

Karim El Ouerghemmi + 1 · Published 2022-01-06 · Updated 2024-03-06 · CVE-2022-21662

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.8.3 WordPress versions prior to 3.7.37

Description Low-privileged authenticated users, such as authors, in the WordPress core are able to execute JavaScript and perform a stored XSS attack, which can affect high-privileged users.

Recommendations For WordPress versions prior to 5.8.3, update to version 5.8.3 or later. For WordPress versions prior to 3.7.37, update to version 3.7.37 or later. Keep auto-updates enabled to ensure the latest security patches are applied. As a temporary workaround, consider restricting access to sensitive areas of the WordPress core until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-WORDPRESS-2022-21662

BIT-WORDPRESS-MULTISITE-2022-21662

CVE-2022-21662

DLA-2884-1

DSA-5039-1

GHSA-699Q-3HJ9-889W

Affected Products

Wordpress

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21662.json · Exploit
• https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21662 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21662 · Security Note
• https://ubuntu.com/security/CVE-2022-21662 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21662 · Vendor Advisory
• https://debian.org/security/2022/dsa-5039 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2884-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21662 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5039-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2022-21662 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-21662 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21662 · Vendor Advisory