Description

WordPress processes shortcodes in user-generated content on block themes. This could allow an attacker to execute shortcodes via submitting comments or other content, allowing them to exploit vulnerabilities that typically require higher permissions. WordPress versions 6.2.x ranging from 6.2 and up to (and including) 6.2.1 are vulnerable.

Remediation

Update to WordPress version 6.2.2 or latest

References

https://wordpress.org/news/2023/05/wordpress-6-2-2-security-release/

Related Vulnerabilities

WordPress Plugin Ultimate Affiliate Pro Multiple Cross-Site Scripting Vulnerabilities (3.6)

WordPress Plugin One page checkout and layouts for woocommerce Unspecified Vulnerability (2.7)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-6379)

WordPress Plugin Advanced Custom Fields (ACF) Cross-Site Scripting (4.4.7)

MODX Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-8775)

Severity

High

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Code Execution