CVE-2021-39202

published 2021-09-09

CVE-2021-39202: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets…

Priority P4 25 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	wordpress	—	—
wordpress	wordpress	—	—
wordpress	wordpress-develop	—	—
wordpress	wordpress-develop	—	—

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

osv 5.4 MEDIUM

vendor_debian 7.6 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79