CVE-2022-4973

MEDIUM EXPLOITED

Wordpress < 6.0.2 - XSS

Title source: rule

Description

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.

References (4)

[Patch] https://core.trac.wordpress.org/changeset/53961

[Release Notes] https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/

[Third Party Advisory] https://www.wordfence.com/blog/2022/08/wordpress-core-6-0-2-security-maintenance-release-what-you-need-to-know/

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/b5582e89-83e6-4898-b9fe-09eddeb5f7ae?source=cve

Scores

CVSS v3 4.9

EPSS 0.0127

EPSS Percentile 79.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitation Intel

VulnCheck KEV 2024-10-15

Classification

CWE

CWE-79

Status published

Affected Products (1)

wordpress/wordpress < 6.0.2

Timeline

Published Oct 16, 2024

Tracked Since Feb 18, 2026