WordPress core
CVE-2021-39202
WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget editor
- Severity
- Medium 5.4
- Published
- 9 Sept 2021
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Fixed in
- 5.8
- Also known as
- GHSA-fr6h-3855-j297
- Sources
- NVD, WordPress
Description
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta…
Affected software
| Software | Affected versions |
|---|---|
WordPressWordPress core · cpe:a:wordpress:wordpress |
|
References
- NVD https://nvd.nist.gov/vuln/detail/CVE-2021-39202
- CVE.org https://www.cve.org/CVERecord?id=CVE-2021-39202
- GitHub Advisory Database https://github.com/advisories/GHSA-fr6h-3855-j297
- WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fr6h-3855-j297