Lucene search

[email protected]CVE-2019-16781

HistoryDec 26, 2019 - 5:15 p.m.

CVE-2019-16781

2019-12-2617:15:13

CWE-79

[email protected]

web.nvd.nist.gov

111

cve-2019-16781

wordpress

authentication

javascript injection

xss

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.7%

JSON

In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.

Affected configurations

Vulners

NVD

Node

wordpresswordpressRange<5.3.1

VendorProductVersionCPE
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wordpress	wordpress	*	cpe:2.3:a:wordpress:wordpress::::::::

CNA Affected

[
  {
    "product": "WordPress",
    "vendor": "WordPress",
    "versions": [
      {
        "lessThan": "5.3.1",
        "status": "affected",
        "version": "< 5.3.1",
        "versionType": "custom"
      }
    ]
  }
]