CVE-2023-38000

published 2023-10-13

CVE-2023-38000: Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from…

Priority P4 24 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
debian	wordpress	< wordpress 6.1.6+dfsg1-0+deb12u1 (bookworm)	wordpress 6.1.6+dfsg1-0+deb12u1 (bookworm)
gutenberg_team	gutenberg	n/a – 16.8.0	—
wordpress.org	wordpress	5.9 – 5.9.7	—
wordpress.org	wordpress	6.0 – 6.0.5	—
wordpress.org	wordpress	6.1 – 6.1.3	—
wordpress.org	wordpress	6.2 – 6.2.2	—
wordpress.org	wordpress	6.3 – 6.3.1	—
wordpress	gutenberg	<= 16.8.0	—
wordpress	wordpress	>= 0 < 6.1.6+dfsg1-0+deb12u1	6.1.6+dfsg1-0+deb12u1
wordpress	wordpress	>= 0 < 6.3.2+dfsg1-1	6.3.2+dfsg1-1
wordpress	wordpress	>= 0 < 6.3.2+dfsg1-1	6.3.2+dfsg1-1
wordpress	wordpress	5.9 – 5.9.7	—
wordpress	wordpress	6.0 – 6.0.5	—
wordpress	wordpress	6.1 – 6.1.3	—
wordpress	wordpress	6.2 – 6.2.2	—
wordpress	wordpress	6.3 – 6.3.1	—

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

osv 5.4 MEDIUM

vendor_debian 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79