CVE-2022-21662highobserved exploitationCWE-79

CVE-2022-21662: high-severity vulnerability in wordpress-develop

Stored XSS in WordPress

Published · Updated

Follow this CVE+ Monitor wordpress-develop+ Monitor wordpress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

55Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 8epss 65%
from disclosure to weapon
Published on NVDJan 6
VulnCheck+225d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
WordPress · wordpress-develop
Related CVEs — wordpress-develop

In the same product, most dangerous first.

CVE-2022-21661HIGHSQL injection in WordPressEPSS 97.8%CVE-2021-29447HIGHWordPress Authenticated XXE attack when installation is running PHP 8EPSS 85.7%CVE-2022-21663MEDIUMAuthenticated Object Injection in Multisites in WordPressEPSS 3.8%CVE-2022-21664HIGHSQL injection in WordPressEPSS 3.7%CVE-2020-4047MEDIUMAuthenticated XSS via media attachment page in WordPressEPSS 3.3%CVE-2024-31211MEDIUMRemote Code Execution in `WP_HTML_Token`EPSS 2.7%