Skip to content
CVE PROGRAM SOURCE RECORD7.6 High

CVE-2021-39202

WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WordPress wordpress-develop

  • 5.8 beta 1affected
  • 5.8 beta 2affected

References