Skip to content
CVE PROGRAM SOURCE RECORD4.9 Medium

CVE-2022-4973

WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WordPress Foundation WordPress

Default version status: unaffected

  • 0 to ≤ 3.6.1affected
  • 3.7 to ≤ 3.7.38affected
  • 3.8 to ≤ 3.8.38affected
  • 3.9 to ≤ 3.9.36affected
  • 4.0 to ≤ 4.0.35affected
  • 4.1 to ≤ 4.1.35affected
  • 4.2 to ≤ 4.2.32affected
  • 4.3 to ≤ 4.3.28affected
  • 4.4 to ≤ 4.4.27affected
  • 4.5 to ≤ 4.5.26affected
  • 4.6 to ≤ 4.6.23affected
  • 4.7 to ≤ 4.7.23affected
  • 4.8 to ≤ 4.8.19affected
  • 4.9 to ≤ 4.9.20affected
  • 5.0 to ≤ 5.0.16affected
  • 5.1 to ≤ 5.1.13affected
  • 5.2 to ≤ 5.2.15affected
  • 5.3 to ≤ 5.3.12affected
  • 5.4 to ≤ 5.4.10affected
  • 5.5 to ≤ 5.5.9affected
  • 5.6 to ≤ 5.6.8affected
  • 5.7 to ≤ 5.7.6affected
  • 5.8 to ≤ 5.8.4affected
  • 5.9 to ≤ 5.9.3affected
  • 6.0 to ≤ 6.0.1affected

References