WordPress Vulnerabilities

WordPress <= 5.0 - Authenticated Cross-Site Scripting (XSS)

Description

According to WordPress:

"Tim Coen discovered that contributors could edit new comments from higher-privileged users, potentially leading to a cross-site scripting vulnerability."

Affects WordPress

3.8.1
Fixed in WordPress 3.8.28
3.8
Fixed in WordPress 3.8.28
3.7.1
Fixed in WordPress 3.7.28
3.9
Fixed in WordPress 3.9.26
3.9.1
Fixed in WordPress 3.9.26
3.7
Fixed in WordPress 3.7.28
3.8.2
Fixed in WordPress 3.8.28
3.8.3
Fixed in WordPress 3.8.28
3.9.2
Fixed in WordPress 3.9.26
4.0
Fixed in WordPress 4.0.25
4.1
Fixed in WordPress 4.1.25
4.1.1
Fixed in WordPress 4.1.25
4.2
Fixed in WordPress 4.2.22
3.9.3
Fixed in WordPress 3.9.26
4.1.2
Fixed in WordPress 4.1.25
4.2.1
Fixed in WordPress 4.2.22
4.0.1
Fixed in WordPress 4.0.25
4.1.5
Fixed in WordPress 4.1.25
4.1.4
Fixed in WordPress 4.1.25
4.1.3
Fixed in WordPress 4.1.25
3.8.4
Fixed in WordPress 3.8.28
3.7.4
Fixed in WordPress 3.7.28
4.2.3
Fixed in WordPress 4.2.22
3.8.8
Fixed in WordPress 3.8.28
3.8.5
Fixed in WordPress 3.8.28
3.8.6
Fixed in WordPress 3.8.28
3.8.7
Fixed in WordPress 3.8.28
3.7.2
Fixed in WordPress 3.7.28
3.7.3
Fixed in WordPress 3.7.28
3.7.5
Fixed in WordPress 3.7.28
3.7.6
Fixed in WordPress 3.7.28
3.7.7
Fixed in WordPress 3.7.28
3.7.8
Fixed in WordPress 3.7.28
3.7.9
Fixed in WordPress 3.7.28
3.8.9
Fixed in WordPress 3.8.28
3.9.4
Fixed in WordPress 3.9.26
3.9.5
Fixed in WordPress 3.9.26
3.9.6
Fixed in WordPress 3.9.26
3.9.7
Fixed in WordPress 3.9.26
4.0.2
Fixed in WordPress 4.0.25
4.0.3
Fixed in WordPress 4.0.25
4.0.4
Fixed in WordPress 4.0.25
4.0.5
Fixed in WordPress 4.0.25
4.0.6
Fixed in WordPress 4.0.25
4.1.6
Fixed in WordPress 4.1.25
4.2.2
Fixed in WordPress 4.2.22
4.2.4
Fixed in WordPress 4.2.22
4.1.7
Fixed in WordPress 4.1.25
4.0.7
Fixed in WordPress 4.0.25
3.9.8
Fixed in WordPress 3.9.26
3.8.10
Fixed in WordPress 3.8.28
3.7.10
Fixed in WordPress 3.7.28
4.3
Fixed in WordPress 4.3.18
4.3.1
Fixed in WordPress 4.3.18
4.2.5
Fixed in WordPress 4.2.22
4.1.8
Fixed in WordPress 4.1.25
4.0.8
Fixed in WordPress 4.0.25
3.9.9
Fixed in WordPress 3.9.26
3.8.11
Fixed in WordPress 3.8.28
3.7.11
Fixed in WordPress 3.7.28
4.4
Fixed in WordPress 4.4.17
3.7.12
Fixed in WordPress 3.7.28
3.8.12
Fixed in WordPress 3.8.28
3.9.10
Fixed in WordPress 3.9.26
4.0.9
Fixed in WordPress 4.0.25
4.1.9
Fixed in WordPress 4.1.25
4.2.6
Fixed in WordPress 4.2.22
4.3.2
Fixed in WordPress 4.3.18
4.4.1
Fixed in WordPress 4.4.17
4.4.2
Fixed in WordPress 4.4.17
4.3.3
Fixed in WordPress 4.3.18
4.2.7
Fixed in WordPress 4.2.22
4.1.10
Fixed in WordPress 4.1.25
4.0.10
Fixed in WordPress 4.0.25
3.9.11
Fixed in WordPress 3.9.26
3.8.13
Fixed in WordPress 3.8.28
3.7.13
Fixed in WordPress 3.7.28
4.5
Fixed in WordPress 4.5.16
4.5.1
Fixed in WordPress 4.5.16
3.7.14
Fixed in WordPress 3.7.28
3.8.14
Fixed in WordPress 3.8.28
3.9.12
Fixed in WordPress 3.9.26
4.0.11
Fixed in WordPress 4.0.25
4.1.11
Fixed in WordPress 4.1.25
4.2.8
Fixed in WordPress 4.2.22
4.3.4
Fixed in WordPress 4.3.18
4.4.3
Fixed in WordPress 4.4.17
4.5.2
Fixed in WordPress 4.5.16
4.5.3
Fixed in WordPress 4.5.16
3.7.15
Fixed in WordPress 3.7.28
3.8.15
Fixed in WordPress 3.8.28
3.9.13
Fixed in WordPress 3.9.26
4.0.12
Fixed in WordPress 4.0.25
4.1.12
Fixed in WordPress 4.1.25
4.2.9
Fixed in WordPress 4.2.22
4.3.5
Fixed in WordPress 4.3.18
4.4.4
Fixed in WordPress 4.4.17
4.6
Fixed in WordPress 4.6.13
3.7.16
Fixed in WordPress 3.7.28
3.8.16
Fixed in WordPress 3.8.28
3.9.14
Fixed in WordPress 3.9.26
4.0.13
Fixed in WordPress 4.0.25
4.1.13
Fixed in WordPress 4.1.25
4.2.10
Fixed in WordPress 4.2.22
4.3.6
Fixed in WordPress 4.3.18
4.4.5
Fixed in WordPress 4.4.17
4.5.4
Fixed in WordPress 4.5.16
4.6.1
Fixed in WordPress 4.6.13
4.7
Fixed in WordPress 4.7.12
3.7.17
Fixed in WordPress 3.7.28
3.8.17
Fixed in WordPress 3.8.28
3.9.15
Fixed in WordPress 3.9.26
4.0.14
Fixed in WordPress 4.0.25
4.1.14
Fixed in WordPress 4.1.25
4.2.11
Fixed in WordPress 4.2.22
4.3.7
Fixed in WordPress 4.3.18
4.4.6
Fixed in WordPress 4.4.17
4.5.5
Fixed in WordPress 4.5.16
4.7.1
Fixed in WordPress 4.7.12
4.6.2
Fixed in WordPress 4.6.13
3.7.18
Fixed in WordPress 3.7.28
3.8.18
Fixed in WordPress 3.8.28
3.9.16
Fixed in WordPress 3.9.26
4.0.15
Fixed in WordPress 4.0.25
4.1.15
Fixed in WordPress 4.1.25
4.2.12
Fixed in WordPress 4.2.22
4.3.8
Fixed in WordPress 4.3.18
4.4.7
Fixed in WordPress 4.4.17
4.5.6
Fixed in WordPress 4.5.16
4.6.3
Fixed in WordPress 4.6.13
4.7.2
Fixed in WordPress 4.7.12
3.7.19
Fixed in WordPress 3.7.28
3.8.19
Fixed in WordPress 3.8.28
3.9.17
Fixed in WordPress 3.9.26
4.0.16
Fixed in WordPress 4.0.25
4.1.16
Fixed in WordPress 4.1.25
4.2.13
Fixed in WordPress 4.2.22
4.3.9
Fixed in WordPress 4.3.18
4.4.8
Fixed in WordPress 4.4.17
4.5.7
Fixed in WordPress 4.5.16
4.6.4
Fixed in WordPress 4.6.13
4.7.3
Fixed in WordPress 4.7.12
3.7.20
Fixed in WordPress 3.7.28
3.8.20
Fixed in WordPress 3.8.28
3.9.18
Fixed in WordPress 3.9.26
4.0.17
Fixed in WordPress 4.0.25
4.1.17
Fixed in WordPress 4.1.25
4.2.14
Fixed in WordPress 4.2.22
4.3.10
Fixed in WordPress 4.3.18
4.4.9
Fixed in WordPress 4.4.17
4.5.8
Fixed in WordPress 4.5.16
4.6.5
Fixed in WordPress 4.6.13
4.7.4
Fixed in WordPress 4.7.12
4.7.5
Fixed in WordPress 4.7.12
3.7.21
Fixed in WordPress 3.7.28
3.8.21
Fixed in WordPress 3.8.28
3.9.19
Fixed in WordPress 3.9.26
4.0.18
Fixed in WordPress 4.0.25
4.1.18
Fixed in WordPress 4.1.25
4.2.15
Fixed in WordPress 4.2.22
4.3.11
Fixed in WordPress 4.3.18
4.4.10
Fixed in WordPress 4.4.17
4.5.9
Fixed in WordPress 4.5.16
4.6.6
Fixed in WordPress 4.6.13
4.8
Fixed in WordPress 4.8.8
4.8.1
Fixed in WordPress 4.8.8
3.7.22
Fixed in WordPress 3.7.28
3.8.22
Fixed in WordPress 3.8.28
3.9.20
Fixed in WordPress 3.9.26
4.0.19
Fixed in WordPress 4.0.25
4.1.19
Fixed in WordPress 4.1.25
4.2.16
Fixed in WordPress 4.2.22
4.3.12
Fixed in WordPress 4.3.18
4.4.11
Fixed in WordPress 4.4.17
4.5.10
Fixed in WordPress 4.5.16
4.6.7
Fixed in WordPress 4.6.13
4.7.6
Fixed in WordPress 4.7.12
4.8.2
Fixed in WordPress 4.8.8
4.8.3
Fixed in WordPress 4.8.8
3.7.23
Fixed in WordPress 3.7.28
3.8.23
Fixed in WordPress 3.8.28
3.9.21
Fixed in WordPress 3.9.26
4.0.20
Fixed in WordPress 4.0.25
4.1.20
Fixed in WordPress 4.1.25
4.2.17
Fixed in WordPress 4.2.22
4.3.13
Fixed in WordPress 4.3.18
4.4.12
Fixed in WordPress 4.4.17
4.5.11
Fixed in WordPress 4.5.16
4.6.8
Fixed in WordPress 4.6.13
4.7.7
Fixed in WordPress 4.7.12
4.9
Fixed in WordPress 4.9.9
4.9.1
Fixed in WordPress 4.9.9
4.8.4
Fixed in WordPress 4.8.8
4.7.8
Fixed in WordPress 4.7.12
4.6.9
Fixed in WordPress 4.6.13
4.5.12
Fixed in WordPress 4.5.16
4.4.13
Fixed in WordPress 4.4.17
4.3.14
Fixed in WordPress 4.3.18
4.2.18
Fixed in WordPress 4.2.22
4.1.21
Fixed in WordPress 4.1.25
4.0.21
Fixed in WordPress 4.0.25
3.9.22
Fixed in WordPress 3.9.26
3.8.24
Fixed in WordPress 3.8.28
3.7.24
Fixed in WordPress 3.7.28
4.9.2
Fixed in WordPress 4.9.9
4.8.5
Fixed in WordPress 4.8.8
4.7.9
Fixed in WordPress 4.7.12
4.6.10
Fixed in WordPress 4.6.13
4.5.13
Fixed in WordPress 4.5.16
4.4.14
Fixed in WordPress 4.4.17
4.3.15
Fixed in WordPress 4.3.18
4.2.19
Fixed in WordPress 4.2.22
4.1.22
Fixed in WordPress 4.1.25
4.0.22
Fixed in WordPress 4.0.25
3.9.23
Fixed in WordPress 3.9.26
3.8.25
Fixed in WordPress 3.8.28
3.7.25
Fixed in WordPress 3.7.28
4.9.3
Fixed in WordPress 4.9.9
4.9.4
Fixed in WordPress 4.9.9
3.7.26
Fixed in WordPress 3.7.28
3.8.26
Fixed in WordPress 3.8.28
3.9.24
Fixed in WordPress 3.9.26
4.0.23
Fixed in WordPress 4.0.25
4.1.23
Fixed in WordPress 4.1.25
4.2.20
Fixed in WordPress 4.2.22
4.3.16
Fixed in WordPress 4.3.18
4.4.15
Fixed in WordPress 4.4.17
4.5.14
Fixed in WordPress 4.5.16
4.6.11
Fixed in WordPress 4.6.13
4.7.10
Fixed in WordPress 4.7.12
4.8.6
Fixed in WordPress 4.8.8
4.9.5
Fixed in WordPress 4.9.9
4.9.6
Fixed in WordPress 4.9.9
3.7.27
Fixed in WordPress 3.7.28
3.8.27
Fixed in WordPress 3.8.28
3.9.25
Fixed in WordPress 3.9.26
4.0.24
Fixed in WordPress 4.0.25
4.1.24
Fixed in WordPress 4.1.25
4.2.21
Fixed in WordPress 4.2.22
4.3.17
Fixed in WordPress 4.3.18
4.4.16
Fixed in WordPress 4.4.17
4.5.15
Fixed in WordPress 4.5.16
4.6.12
Fixed in WordPress 4.6.13
4.7.11
Fixed in WordPress 4.7.12
4.8.7
Fixed in WordPress 4.8.8
4.9.7
Fixed in WordPress 4.9.9
4.9.8
Fixed in WordPress 4.9.9
5.0
Fixed in WordPress 5.0.1

References

CVE
CVE-2018-20153
URL
https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Tim Coen
Submitter
Ryan Dewhurst
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
3182002e-d831-4412-a27d-a5e39bb44314

Timeline

Publicly Published
2018-12-13 (about 5 years ago)
Added
2018-12-13 (about 5 years ago)
Last Updated
2020-09-22 (about 3 years ago)

Other

Published
Title
Published
2024-02-12
Title
Maspik – Spam blacklist < 0.10.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Published
2023-09-25
Title
PageLayer < 1.7.7 - Unauthenticated Stored XSS
Published
2023-10-12
Title
WP Report Post <= 2.1.2 - Reflected XSS
Published
2021-08-30
Title
TranslatePress < 2.0.9 - Authenticated Stored Cross-Site Scripting
Published
2023-12-23
Title
Colibri Page Builder < 1.0.240 - Contributor+ Stored XSS