CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-20041 – WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-20041
wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring. La función wp_kses_bad_protocol en el archivo wp-includes/kses.php en WordPress versiones anteriores a la versión 5.3.1, maneja inapropiadamente la entidad llamada HTML5 colon, permitiendo a atacantes omitir el saneamiento de entrada, como es demostrado por la subcadena javascript&colon. • https://github.com/WordPress/wordpress-develop/commit/b1975463dd995da19bb40d3fa0786498717e3c53 https://lists.debian.org/debian-lts-announce/2020/01/msg00010.html https://seclists.org/bugtraq/2020/Jan/8 https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release https://www.debian.org/security/2020/dsa-4599 https://www.debian.org/security/2020/dsa-4677 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2019-20042 – WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-20042
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. En wp-includes / formatting.php en WordPress 3.7 a 5.3.0, la función wp_targeted_link_rel () se puede usar de una manera particular para generar una vulnerabilidad de scripting entre sitios (XSS) almacenada. Esto se ha solucionado en WordPress 5.3.1, junto con todas las versiones anteriores de WordPress desde 3.7 a 5.3 a través de una versión menor. • https://blog.ripstech.com/filter/vulnerabilities https://core.trac.wordpress.org/changeset/46894/trunk https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1d https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xvg2-m2f4-83m7 https://hackerone.com/reports/509930 https://seclists.org/bugtraq/2020/Jan/8 https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release https://wpvulndb.com/vulnerabilities/9975 https://www.debian.org&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16780 – Stored cross-site scripting (XSS) in WordPress block editor
https://notcve.org/view.php?id=CVE-2019-16780
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled. • https://github.com/WordPress/wordpress-develop/commit/505dd6a20b6fc3d06130018c1caeff764248c29e https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x3wp-h3qx-9w94 https://hackerone.com/reports/738644 https://seclists.org/bugtraq/2020/Jan/8 https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release https://wpvulndb.com/vulnerabilities/9976 https://www.debian.org/security/2020/dsa-4599 https://www.debian.org/security/2020/dsa-4677 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-16781 – Stored cross-site scripting (XSS) in WordPress block editor
https://notcve.org/view.php?id=CVE-2019-16781
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS. En WordPress versiones anteriores a 5.3.1, los usuarios autenticados con privilegios más bajos (como los contribuyentes) pueden inyectar código JavaScript en el editor de bloques, que es ejecutado dentro del panel. Puede conllevar a un administrador a abrir la publicación afectada en el editor conllevando a un ataque de tipo XSS. • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9v https://hackerone.com/reports/731301 https://seclists.org/bugtraq/2020/Jan/8 https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release https://wpvulndb.com/vulnerabilities/9976 https://www.debian.org/security/2020/dsa-4599 https://www.debian.org/security/2020/dsa-4677 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2019-20043 – WordPress Core < 5.3.1 - Authorization Bypass
https://notcve.org/view.php?id=CVE-2019-20043
In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. En wp-includes / rest-api / endpoints / class-wp-rest-posts-controller.php en WordPress 3.7 a 5.3.0, los usuarios autenticados que no tienen los derechos para publicar una publicación pueden marcar publicaciones como fijas o antiadherente a través de la API REST. Por ejemplo, el rol de contribuyente no tiene tales derechos, pero esto les permitió evitarlo. • https://core.trac.wordpress.org/changeset/46893/trunk https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9 https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw https://seclists.org/bugtraq/2020/Jan/8 https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release https://wpvulndb.com/vulnerabilities/9973 https://www.debian.org/security/2020/dsa-4599 https://www.debian.org/security/2020/dsa-4677 • CWE-269: Improper Privilege Management CWE-285: Improper Authorization •