CVE-2021-39201

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392025.4WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio CVE-2021-392036.5WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio CVE-2021-392047.5Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams w CVE-2021-392056.1Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting v CVE-2021-392068.6Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilitie CVE-2021-392078.8parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the pac CVE-2021-392084.3SharpCompress is a fully managed C# library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to part CVE-2021-392098.8GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site R CVE-2021-39214.3firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-392106.5GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a u CVE-2021-392115.3GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint disclose CVE-2021-392123.6ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribut