CVE-2019-16219
published 2019-09-11CVE-2019-16219: WordPress before 5.2.3 allows XSS in shortcode previews.
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.89%
77.2th percentile
WordPress before 5.2.3 allows XSS in shortcode previews.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | wordpress | < wordpress 5.2.3+dfsg1-1 (bookworm) | wordpress 5.2.3+dfsg1-1 (bookworm) |
| wordpress | wordpress | < 5.2.3 | 5.2.3 |
| wordpress | wordpress | >= 0 < 5.2.3+dfsg1-1 | 5.2.3+dfsg1-1 |
| wordpress | wordpress | >= 0 < 5.2.3+dfsg1-1 | 5.2.3+dfsg1-1 |
| wordpress | wordpress | >= 0 < 5.2.3+dfsg1-1 | 5.2.3+dfsg1-1 |
| wordpress | wordpress | >= 0 < 5.2.3+dfsg1-1 | 5.2.3+dfsg1-1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hqq8-34fg-q5jj: WordPress before 5
ghsa_unreviewed·2022-05-24
CVE-2019-16219 [MEDIUM] CWE-79 GHSA-hqq8-34fg-q5jj: WordPress before 5
WordPress before 5.2.3 allows XSS in shortcode previews.
OSV
CVE-2019-16219: WordPress before 5
osv·2019-09-11·CVSS 6.1
CVE-2019-16219 [MEDIUM] CVE-2019-16219: WordPress before 5
WordPress before 5.2.3 allows XSS in shortcode previews.
Debian
CVE-2019-16219: wordpress - WordPress before 5.2.3 allows XSS in shortcode previews.
vendor_debian·2019·CVSS 6.1
CVE-2019-16219 [MEDIUM] CVE-2019-16219: wordpress - WordPress before 5.2.3 allows XSS in shortcode previews.
WordPress before 5.2.3 allows XSS in shortcode previews.
Scope: local
bookworm: resolved (fixed in 5.2.3+dfsg1-1)
bullseye: resolved (fixed in 5.2.3+dfsg1-1)
forky: resolved (fixed in 5.2.3+dfsg1-1)
sid: resolved (fixed in 5.2.3+dfsg1-1)
trixie: resolved (fixed in 5.2.3+dfsg1-1)
No detection rules found.
No public exploits indexed.
HackerOne
Version problem in wordpress leads to the many vulnearability
hackerone·2020-01-10·CVSS 6.1
[MEDIUM] Version problem in wordpress leads to the many vulnearability
Version problem in wordpress leads to the many vulnearability
##Title: WordPress 3.9-5.1 - Comment Cross-Site Scripting (XSS)
Reference: https://wpvulndb.com/vulnerabilities/9230
Reference: https://github.com/WordPress/WordPress/commit/0292de60ec78c5a44956765189403654fe4d080b
Reference: https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/
Reference: https://blog.ripstech.com/2019/wordpress-csrf-to-rce/
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9787
## Title: WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation
Reference: https://wpvulndb.com/vulnerabilities/9867
Reference: https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/
Reference: https://github.com/WordPress/WordPress/commit/30a
Bugzilla
CVE-2019-16219 wordpress: XSS in shortcode previews [epel-6]
bugzilla·2019-11-25·CVSS 6.1
CVE-2019-16219 [MEDIUM] CVE-2019-16219 wordpress: XSS in shortcode previews [epel-6]
CVE-2019-16219 wordpress: XSS in shortcode previews [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to for the 'fedpkg update' reques
Bugzilla
CVE-2019-16219 wordpress: XSS in shortcode previews
bugzilla·2019-11-25·CVSS 6.1
CVE-2019-16219 [MEDIUM] CVE-2019-16219 wordpress: XSS in shortcode previews
CVE-2019-16219 wordpress: XSS in shortcode previews
WordPress before 5.2.3 allows XSS in shortcode previews.
Reference:
https://wpvulndb.com/vulnerabilities/9864
Discussion:
Created wordpress tracking bugs for this issue:
Affects: epel-6 [bug 1776433]
Affects: epel-7 [bug 1776434]
---
Fixed in 5.2.4
Bugzilla
CVE-2019-16219 wordpress: XSS in shortcode previews [epel-7]
bugzilla·2019-11-25·CVSS 6.1
CVE-2019-16219 [MEDIUM] CVE-2019-16219 wordpress: XSS in shortcode previews [epel-7]
CVE-2019-16219 wordpress: XSS in shortcode previews [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to for the 'fedpkg update' reques
Fortinet
WordPress (Core) Stored XSS Vulnerability: An Analysis | FortiGuard Labs
blogs_fortinet·2019-09-12·CVSS 6.1
[MEDIUM] WordPress (Core) Stored XSS Vulnerability: An Analysis | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
WordPress (Core) Stored XSS Vulnerability: An Analysis
By Zhouyuan Yang | September 12, 2019
WordPress is the world’s most popular Content Management System (CMS). It has 60.4% of the global CMS market share, which is far higher than the second-place CMS, Joomla!, which only has 5.2% of the market share. As a result, over a third of all of the websites on the Internet were built using WordPress.
The FortiGuard Labs team recently discovered a stored Cross-Site Scripting (XSS) zero-day vulnerability in WordPress. This XSS vulnerability is caused by the new built-in editor Gutenberg found in WordPress 5.0. The editor fails to filter the JavaScript/HTML code in the Shortcode error message. This allows a remote attacker with Contributor or higher permission to
https://fortiguard.com/zeroday/FG-VD-18-165https://lists.debian.org/debian-lts-announce/2019/10/msg00023.htmlhttps://seclists.org/bugtraq/2020/Jan/8https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/9864https://www.debian.org/security/2020/dsa-4599https://www.debian.org/security/2020/dsa-4677https://fortiguard.com/zeroday/FG-VD-18-165https://lists.debian.org/debian-lts-announce/2019/10/msg00023.htmlhttps://seclists.org/bugtraq/2020/Jan/8https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/9864https://www.debian.org/security/2020/dsa-4599https://www.debian.org/security/2020/dsa-4677
2019-09-11
Published