Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block

CVE-2023-38000
5.4MEDIUM

Key Information

Vendor
WordPress
Status
WordPress
Gutenberg
Vendor
CVE Published:
13 October 2023

Summary

Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

Affected Version(s)

WordPress <= 6.3.1

WordPress <= 6.2.2

WordPress <= 6.1.3

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Rafie Muhammad (Patchstack)
Edouard Lamoine (Patchstack)
.