Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WordPress 5.3.1 Clear all filters
TI-2019-12561 CVE-2019-16781

Stored cross-site scripting (XSS) in WordPress block editor

Priority LOW 29

In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard.

CVSS 3.1MEDIUM 5.8 Network Low privileges User interaction EPSS 0.01612 Published 2019-12-26 Fixed in 5.3.1 CWE-79
TI-2019-12560 CVE-2019-16780

Stored cross-site scripting (XSS) in WordPress block editor

Priority LOW 29

WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard.

CVSS 3.1MEDIUM 5.8 Network Low privileges User interaction EPSS 0.01697 Published 2019-12-26 Fixed in 5.3.1 CWE-79