CVE-2022-21662: Stored XSS in WordPress
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 6.1.9+dfsg1-0+deb12u1Fixed in 6.8.7+dfsg1-0+deb13u1Fixed in 6.8.12+dfsg1-0+deb13u1Fixed in 7.1.4+dfsg1-1 - Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 5.8.3+dfsg1-1 - Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 5.8.3 - Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 3.7.37 - Configuration
Keep auto-updates enabled
WordPress auto-updates = enabled
Event History
Frequently Asked Questions
What is CVE-2022-21662?
CVE-2022-21662 is a vulnerability in WordPress that allows low-privileged authenticated users to perform stored XSS attacks, potentially impacting high-privileged users.
How does CVE-2022-21662 affect WordPress?
CVE-2022-21662 affects WordPress by allowing low-privileged authenticated users to execute JavaScript and perform stored XSS attacks.
What is the severity of CVE-2022-21662?
The severity of CVE-2022-21662 is rated as high.
Which versions of WordPress are affected by CVE-2022-21662?
WordPress versions up to and excluding 5.8.3 are affected by CVE-2022-21662.
How can I fix CVE-2022-21662 in WordPress?
To fix CVE-2022-21662, update WordPress to version 5.8.3 or newer.