CVE-2023-38000

score

<0.1

cvss

6.5

epss

0.9%

published

2023-10-13

kev added

—

first seen

2026-10-21

WordPress core versions 5.9 through 5.9.7, 6.0 through 6.0.5, 6.1 through 6.1.3, 6.2 through 6.2.2, 6.3 through 6.3.1, and Gutenberg plugin <= 16.8.0 contain a stored cross-site scripting caused by insufficient sanitization in authentication-related features, letting attackers execute malicious scripts in the context of the affected site, exploit requires attacker to have contributor or higher privileges.