CVE-2021-39202

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WordPress	wordpress-develop	5.8 beta 1; 5.8 beta 2

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fr6h-3855-j297Third Party Advisory
https://hackerone.com/reports/1222797Permissions Required
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fr6h-3855-j297Third Party Advisory
https://hackerone.com/reports/1222797Permissions Required

Timeline

Published: Sep 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392036.5WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio CVE-2021-392047.5Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams w CVE-2021-392056.1Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting v CVE-2021-392068.6Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilitie CVE-2021-392078.8parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the pac CVE-2021-392084.3SharpCompress is a fully managed C# library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to part CVE-2021-392098.8GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site R CVE-2021-39214.3firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-392106.5GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a u CVE-2021-392115.3GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint disclose CVE-2021-392123.6ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribut CVE-2021-392138.8GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is v