WordPress CVEs

Description

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.

Affected WordPress components

• WordPress core
  Confirmed match
  Up to and including 6.0.2
• wordpress Plugin · wordpress
  Possible match Homeless
  From 6.0 (including) to 6.0.1 (including); From 5.9 (including) to 5.9.3 (including); From 5.8 (including) to 5.8.4 (including); From 5.7 (including) to 5.7.6 (including); From 5.6 (including) to 5.6.8 (including); From 5.5 (including) to 5.5.9 (including); From 5.4 (including) to 5.4.10 (including); From 5.3 (including) to 5.3.12 (including); From 5.2 (including) to 5.2.15 (including); From 5.1 (including) to 5.1.13 (including); From 5.0 (including) to 5.0.16 (including); From 4.9 (including) to 4.9.20 (including); From 4.8 (including) to 4.8.19 (including); From 4.7 (including) to 4.7.23 (including); From 4.6 (including) to 4.6.23 (including); From 4.5 (including) to 4.5.26 (including); From 4.4 (including) to 4.4.27 (including); From 4.3 (including) to 4.3.28 (including); From 4.2 (including) to 4.2.32 (including); From 4.1 (including) to 4.1.35 (including); From 4.0 (including) to 4.0.35 (including); From 3.9 (including) to 3.9.36 (including); From 3.8 (including) to 3.8.38 (including); From 3.7 (including) to 3.7.38 (including); Up to and including 3.6.1
  View on WordPress.org
• wordpress Theme · wordpress
  Possible match Homeless
  From 6.0 (including) to 6.0.1 (including); From 5.9 (including) to 5.9.3 (including); From 5.8 (including) to 5.8.4 (including); From 5.7 (including) to 5.7.6 (including); From 5.6 (including) to 5.6.8 (including); From 5.5 (including) to 5.5.9 (including); From 5.4 (including) to 5.4.10 (including); From 5.3 (including) to 5.3.12 (including); From 5.2 (including) to 5.2.15 (including); From 5.1 (including) to 5.1.13 (including); From 5.0 (including) to 5.0.16 (including); From 4.9 (including) to 4.9.20 (including); From 4.8 (including) to 4.8.19 (including); From 4.7 (including) to 4.7.23 (including); From 4.6 (including) to 4.6.23 (including); From 4.5 (including) to 4.5.26 (including); From 4.4 (including) to 4.4.27 (including); From 4.3 (including) to 4.3.28 (including); From 4.2 (including) to 4.2.32 (including); From 4.1 (including) to 4.1.35 (including); From 4.0 (including) to 4.0.35 (including); From 3.9 (including) to 3.9.36 (including); From 3.8 (including) to 3.8.38 (including); From 3.7 (including) to 3.7.38 (including); Up to and including 3.6.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• WordPress Foundation WordPress — Up to and including 3.6.1
• WordPress Foundation WordPress — From 3.7 (including) to 3.7.38 (including)
• WordPress Foundation WordPress — From 3.8 (including) to 3.8.38 (including)
• WordPress Foundation WordPress — From 3.9 (including) to 3.9.36 (including)
• WordPress Foundation WordPress — From 4.0 (including) to 4.0.35 (including)
• WordPress Foundation WordPress — From 4.1 (including) to 4.1.35 (including)
• WordPress Foundation WordPress — From 4.2 (including) to 4.2.32 (including)
• WordPress Foundation WordPress — From 4.3 (including) to 4.3.28 (including)
• WordPress Foundation WordPress — From 4.4 (including) to 4.4.27 (including)
• WordPress Foundation WordPress — From 4.5 (including) to 4.5.26 (including)
• WordPress Foundation WordPress — From 4.6 (including) to 4.6.23 (including)
• WordPress Foundation WordPress — From 4.7 (including) to 4.7.23 (including)
• WordPress Foundation WordPress — From 4.8 (including) to 4.8.19 (including)
• WordPress Foundation WordPress — From 4.9 (including) to 4.9.20 (including)
• WordPress Foundation WordPress — From 5.0 (including) to 5.0.16 (including)
• WordPress Foundation WordPress — From 5.1 (including) to 5.1.13 (including)
• WordPress Foundation WordPress — From 5.2 (including) to 5.2.15 (including)
• WordPress Foundation WordPress — From 5.3 (including) to 5.3.12 (including)
• WordPress Foundation WordPress — From 5.4 (including) to 5.4.10 (including)
• WordPress Foundation WordPress — From 5.5 (including) to 5.5.9 (including)
• WordPress Foundation WordPress — From 5.6 (including) to 5.6.8 (including)
• WordPress Foundation WordPress — From 5.7 (including) to 5.7.6 (including)
• WordPress Foundation WordPress — From 5.8 (including) to 5.8.4 (including)
• WordPress Foundation WordPress — From 5.9 (including) to 5.9.3 (including)
• WordPress Foundation WordPress — From 6.0 (including) to 6.0.1 (including)
• wordpress wordpress — Up to and including 6.0.2

References

• core.trac.wordpress.org https://core.trac.wordpress.org/changeset/53961 Patch
• wordpress.org https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/ Release Notes
• www.wordfence.com https://www.wordfence.com/blog/2022/08/wordpress-core-6-0-2-security-maintenance-release-what-you-need-to-know/ Third Party Advisory
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/b5582e89-83e6-4898-b9fe-09eddeb5f7ae?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record