WordPress < 6.5.5 - Contributor+ Stored XSS in HTML API

2024-06-2500:00:00

wpscan.com

wordpress

stored xss

html api

url attributes

cross-site scripting

5.7 Medium

AI Score

Confidence

High

JSON

Description WordPress does not properly escape URL attributes in the HTML API, allowing high-privileged users to perform Stored Cross-Site Scripting (XSS) attacks.

CPENameOperatorVersion
654eq6.5.5
654eq6.5.5
654eq6.5.5
654eq6.5.5
654eq6.5.5
654eq6.4.5
654eq6.4.5
654eq6.4.5
654eq6.4.5
654eq6.4.5

Name	Operator	Version
654	eq	6.5.5
654	eq	6.5.5
654	eq	6.5.5
654	eq	6.5.5
654	eq	6.5.5
654	eq	6.4.5
654	eq	6.4.5
654	eq	6.4.5
654	eq	6.4.5
654	eq	6.4.5

Rows per page:

1-10 of 4811

References

wordpress.org/news/2024/06/wordpress-6-5-5/

5.7 Medium

AI Score

Confidence

High

JSON