CVE-2022-4973

EUVD-2022-53925
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.9 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.81%
Affected Products (NVD)
VendorProductVersion
wordpresswordpress
𝑥
≤ 6.0.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
wordpress
bookworm
6.1.9+dfsg1-0+deb12u1
fixed
bookworm (security)
6.1.9+dfsg1-0+deb12u1
fixed
bullseye
5.7.11+dfsg1-0+deb11u1
fixed
bullseye (security)
5.7.14+dfsg1-0+deb11u1
fixed
forky
7.0+dfsg1-1
fixed
sid
7.0.2+dfsg1-1
fixed
trixie
6.8.3+dfsg1-0+deb13u1
fixed
trixie (security)
6.8.3+dfsg1-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
wordpress
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
xenial
ignored
Common Weakness Enumeration
References
https://core.trac.wordpress.org/changeset/53961
https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/
https://www.wordfence.com/blog/2022/08/wordpress-core-6-0-2-security-maintenance-release-what-you-need-to-know/
https://www.wordfence.com/threat-intel/vulnerabilities/id/b5582e89-83e6-4898-b9fe-09eddeb5f7ae?source=cve