UpHeron
All vulnerabilities

WordPress core

CVE-2020-4049

WordPress: Authenticated self-XSS via theme uploads

Severity
Low 2.4
Published
12 Jun 2020
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2
Also known as
GHSA-87h4-phjv-rm6p
Sources
NVD, WordPress

Description

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6,…

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • From 5.4 before 5.4.2
  • From 5.3.0 before 5.3.4
  • From 5.2 before 5.2.7
  • From 5.1 before 5.1.6
All 19 release lines
  • From 3.7 before 5.4.2
  • From 3.7 before 3.7.34
  • From 3.8 before 3.8.34
  • From 3.9 before 3.9.32
  • From 4.0 before 4.0.31
  • From 4.1 before 4.1.31
  • From 4.2 before 4.2.28
  • From 4.3 before 4.3.24
  • From 4.4 before 4.4.23
  • From 4.5 before 4.5.22
  • From 4.6 before 4.6.19
  • From 4.7 before 4.7.18
  • From 4.8 before 4.8.14
  • From 4.9 before 4.9.15
  • From 5.0 before 5.0.10
  • From 5.1 before 5.1.6
  • From 5.2 before 5.2.7
  • From 5.3.0 before 5.3.4
  • From 5.4 before 5.4.2

References