CVE-2019-16780
Stored cross-site scripting (XSS) in WordPress block editor
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.
Los usuarios de WordPress con privilegios más bajos (como los contribuyentes) pueden inyectar código JavaScript en el editor de bloques usando una carga útil específica, que es ejecutada dentro del panel. Esto puede conllevar a un ataque de tipo XSS si un administrador abre la publicación en el editor. La ejecución de este ataque requiere de un usuario autenticado. Esto ha sido parcheado en WordPress versión 5.3.1, junto con todas las versiones anteriores de WordPress desde 3.7 hasta 5.3 por medio de una versión menor. Las actualizaciones automáticas están habilitadas por defecto para versiones menores y recomendamos encarecidamente que las mantenga habilitadas.
Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-09-24 CVE Reserved
- 2019-12-13 CVE Published
- 2024-08-05 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x3wp-h3qx-9w94 | Third Party Advisory | |
| https://seclists.org/bugtraq/2020/Jan/8 | Mailing List |
|
| https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release | Release Notes | |
| https://wpvulndb.com/vulnerabilities/9976 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/WordPress/wordpress-develop/commit/505dd6a20b6fc3d06130018c1caeff764248c29e | 2022-11-23 |
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2020/dsa-4599 | 2022-11-23 | |
| https://www.debian.org/security/2020/dsa-4677 | 2022-11-23 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | > 3.7 < 5.3.1 Search vendor "Wordpress" for product "Wordpress" and version " > 3.7 < 5.3.1" | - |
Affected
| ||||||
| Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | 3.7 Search vendor "Wordpress" for product "Wordpress" and version "3.7" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||