CVE-2021-39201

Description

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)

Affected packages (4)

• Bitnami/wordpress>= 5.0.0, < 5.8.0
• Bitnami/wordpress-multisite>= 5.0.0, < 5.8.0
• Debian/wordpressfrom 0, < 5.7.3+dfsg1-0+deb11u1
• Debian/wordpressfrom 0, < 5.0.14+dfsg1-0+deb10u1

CVSS scores

References (5)

• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-39201
• WEBhttps://github.com/WordPress/wordpress-develop/security/advisories/GHSA-wh69-25hr-h94v
• WEBhttps://hackerone.com/reports/1142140
• WEBhttps://nvd.nist.gov/vuln/detail/CVE-2021-39201
• WEBhttps://www.debian.org/security/2021/dsa-4985