CVE-2022-21662

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WordPress	wordpress-develop	< 5.8.3

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889wThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00019.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/
https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/Release Notes, Vendor Advisory
https://www.debian.org/security/2022/dsa-5039Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889wThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00019.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/
https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/Release Notes, Vendor Advisory
https://www.debian.org/security/2022/dsa-5039Third Party Advisory

Timeline

Published: Jan 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-216637.2WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with CVE-2022-216648.8WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanit CVE-2022-216667.2Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injection CVE-2022-216677.5soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it CVE-2022-216688.6pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of r CVE-2022-216697.5PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible CVE-2022-21676.1The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, lea CVE-2022-216705.3markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down CVE-2022-216716.5@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive informati CVE-2022-216726.5make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to CVE-2022-216734.3Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity CVE-2022-216757.8Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File