onyx --cves cve-2019-16780
CVE-2019-16780
- score
- <0.1
- cvss
- 5.8
- epss
- 1.7%
- published
- 2019-12-26
- kev added
- —
- first seen
WordPress versions from 3.7 to 5.3 contain a stored cross-site scripting caused by JavaScript injection payload in the block editor, letting lower-privileged users execute scripts when an admin opens the post, exploit requires user authentication.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 8
- https://www.debian.org/security/2020/dsa-4599
- https://www.debian.org/security/2020/dsa-4677
- https://github.com/WordPress/wordpress-develop/commit/505dd6a20b6fc3d06130018c1caeff764248c29e
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x3wp-h3qx-9w94
- https://hackerone.com/reports/738644
- https://seclists.org/bugtraq/2020/Jan/8
- https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
- https://wpvulndb.com/vulnerabilities/9976