onyx --cves cve-2022-4973
CVE-2022-4973
- score
- <0.1
- cvss
- 4.9
- epss
- 0.4%
- published
- 2024-10-16
- kev added
- 2024-10-15
- first seen
WordPress Core up to 6.0.2 contains an authenticated stored cross-site scripting caused by unsanitized input in posts and pages, letting users with editor access inject scripts that execute when the_meta() is called, exploit requires user with post editing privileges.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Added to CISA KEV
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b5582e89-83e6-4898-b9fe-09eddeb5f7ae?source=cve
- https://core.trac.wordpress.org/changeset/53961
- https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-602-authenticated-contributor-stored-cross-site-scripting-via-use-of-the-meta-function?asset_slug=wordpress
- https://www.wordfence.com/blog/2022/08/wordpress-core-6-0-2-security-maintenance-release-what-you-need-to-know/