PT-2022-21956 · WordPress · Gutenberg

Phoenix · Published 2022-07-30 · Updated 2022-08-16 · CVE-2022-33994

Positive Technologies (AI Summary)

CVSS v3.1

3.0

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gutenberg plugin versions through 13.7.3 for WordPress

Description The issue allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. The XSS payload does not execute in the context of the WordPress instance's domain. However, some similar products block analogous attempts by low-privileged users to reference SVG documents, and this behavioral difference might have security relevance to some WordPress site administrators.

Recommendations For versions through 13.7.3, consider disabling the "Insert from URL" feature until a patch is available to prevent exploitation. Restrict access to the SVG document upload functionality to minimize the risk of stored XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-33994

Affected Products

Gutenberg

References · 6

• 🔥 https://patchstack.com/articles/patchstack-weekly-svg-xss-reported-in-gutenberg · Exploit
• https://osv.dev/vulnerability/CVE-2022-33994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33994 · Security Note
• https://t.me/cvenotify/34465 · Telegram Post
• https://t.me/cvenotify/34054 · Telegram Post
• https://blog.jitendrapatro.me/cve-2022-33994-stored-xss-in-wordpress · Note