WordPress core
CVE-2022-21662
WordPress: Stored XSS through authenticated users
- Severity
- Medium 5.4
- Published
- 6 Jan 2022
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Fixed in
- 5.8.3
- Also known as
- GHSA-699q-3hj9-889w
- Sources
- NVD, WordPress
Description
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go…
Affected software
| Software | Affected versions |
|---|---|
WordPressWordPress core · cpe:a:wordpress:wordpress |
|
References
- NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21662
- CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21662
- GitHub Advisory Database https://github.com/advisories/GHSA-699q-3hj9-889w
- WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889w