CVE-2022-4973mediumexploração observadaCWE-79

CVE-2022-4973: falha de média gravidade em WordPress

WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WordPress+ Monitorar wordpress

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

35Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Attendcvss 4.9epss 0.4%
da publicação à arma
Publicada no NVD16 de out.
VulnCheck15 de out.
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
WordPress Foundation · WordPress
CVEs relacionadas — WordPress

No mesmo produto, das mais perigosas para as menos.

CVE-2026-119977HIGHWordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code ExecutionEPSS 1.2%KEVCVE-2023-2745MEDIUMWordPress Core < 6.2.1 - Directory TraversalEPSS 79.7%CVE-2024-4439HIGHCVE-2024-4439EPSS 71.0%CVE-2023-5692MEDIUMWordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalinkEPSS 0.8%CVE-2024-6307MEDIUMWordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML APIEPSS 0.5%CVE-2026-3906MEDIUMWordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST APIEPSS 0.4%