CVE-2019-16781: Stored cross-site scripting (XSS) in WordPress block editor
First published: Thu Dec 26 2019(Updated: )
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress WordPress | <5.3.1 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| debian/wordpress | 5.0.15+dfsg1-0+deb10u1 5.0.19+dfsg1-0+deb10u1 5.7.8+dfsg1-0+deb11u2 6.1.1+dfsg1-1 6.3.1+dfsg1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9v
- https://hackerone.com/reports/731301
- https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
- https://security-tracker.debian.org/tracker/CVE-2019-16781
- https://seclists.org/bugtraq/2020/Jan/8
- https://wpvulndb.com/vulnerabilities/9976
- https://www.debian.org/security/2020/dsa-4599
- https://www.debian.org/security/2020/dsa-4677
Frequently Asked Questions
What is CVE-2019-16781?
CVE-2019-16781 is a vulnerability in WordPress before version 5.3.1 that allows authenticated users with lower privileges to inject JavaScript code in the block editor, leading to potential cross-site scripting (XSS).
How severe is CVE-2019-16781?
CVE-2019-16781 has a severity level of medium with a CVSS score of 5.4.
Can contributors in WordPress exploit CVE-2019-16781?
Yes, authenticated users with lower privileges like contributors can exploit CVE-2019-16781.
How can I fix CVE-2019-16781 in WordPress?
To fix CVE-2019-16781, you should update WordPress to version 5.3.1 or later. Additionally, you can apply any relevant security patches provided by your distribution or vendor.
Where can I find more information about CVE-2019-16781?
You can find more information about CVE-2019-16781 on the following references: [GitHub Advisory](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9v), [HackerOne Report](https://hackerone.com/reports/731301), [Security Mailing List](https://seclists.org/bugtraq/2020/Jan/8).
- collector/security-tracker-debian
- agent/references
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- package-manager/debian
- vendor/wordpress
- canonical/wordpress wordpress
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0