TI-2023-19432 Aliases CVE-2023-38000 GHSA-ggq5-xv35-rxhf

Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block

LOW 30CWE-79Published 2023-10-13 · Updated 2026-04-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

Why it matters now

EPSS 0.00872 59th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WordPress	WordPress	6.3 – 6.3.1; 6.2 – 6.2.2; 6.1 – 6.1.3; 6.0 – 6.0.5; 5.9 – 5.9.7	—	No fix listed	CNA
Gutenberg Team	Gutenberg	up to 16.8.0	—	No fix listed	CNA

WordPress VendorWordPress Affected 6.3 – 6.3.1; 6.2 – 6.2.2; 6.1 – 6.1.3; 6.0 – 6.0.5; 5.9 – 5.9.7 Fixed in — No fix listed CNA
Gutenberg VendorGutenberg Team Affected up to 16.8.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:wordpress:wordpress::::::::	5.9 – 5.9.7; 6.0 – 6.0.5; 6.1 – 6.1.3; 6.2 – 6.2.2; 6.3 – 6.3.1	Vulnerable	WordPress
cpe:2.3:a:wordpress:gutenberg::::::wordpress::*	up to 16.8.0	Vulnerable	WordPress

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions 5.9 – 5.9.7; 6.0 – 6.0.5; 6.1 – 6.1.3; 6.2 – 6.2.2; 6.3 – 6.3.1 Vulnerable ·WordPress
cpe:2.3:a:wordpress:gutenberg:*:*:*:*:*:wordpress:*:* Versions up to 16.8.0 Vulnerable ·WordPress

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-38000
2026-10-03 Alias added: GHSA-ggq5-xv35-rxhf

References

Exploit 1

https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences