WordPress Vulnerabilities

WP 5.6-6.3.1 - Reflected XSS via Application Password Requests

Description

WordPress does not sanitise and escape the success_url and reject_url parameters before outputting it back in the page when requesting application passwords, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affects WordPress

6.3.1
Fixed in WordPress 6.3.2
6.3
Fixed in WordPress 6.3.2
6.2.2
Fixed in WordPress 6.2.3
6.2.1
Fixed in WordPress 6.2.3
6.2
Fixed in WordPress 6.2.3
6.1.3
Fixed in WordPress 6.1.4
6.1.2
Fixed in WordPress 6.1.4
6.1.1
Fixed in WordPress 6.1.4
6.1
Fixed in WordPress 6.1.4
6.0.5
Fixed in WordPress 6.0.6
6.0.4
Fixed in WordPress 6.0.6
6.0.3
Fixed in WordPress 6.0.6
6.0.2
Fixed in WordPress 6.0.6
6.0.1
Fixed in WordPress 6.0.6
6.0
Fixed in WordPress 6.0.6
5.9.7
Fixed in WordPress 5.9.8
5.9.6
Fixed in WordPress 5.9.8
5.9.5
Fixed in WordPress 5.9.8
5.9.4
Fixed in WordPress 5.9.8
5.9.3
Fixed in WordPress 5.9.8
5.9.2
Fixed in WordPress 5.9.8
5.9.1
Fixed in WordPress 5.9.8
5.9
Fixed in WordPress 5.9.8
5.8.7
Fixed in WordPress 5.8.8
5.8.6
Fixed in WordPress 5.8.8
5.8.5
Fixed in WordPress 5.8.8
5.8.4
Fixed in WordPress 5.8.8
5.8.3
Fixed in WordPress 5.8.8
5.8.2
Fixed in WordPress 5.8.8
5.8.1
Fixed in WordPress 5.8.8
5.8
Fixed in WordPress 5.8.8
5.7.9
Fixed in WordPress 5.7.10
5.7.8
Fixed in WordPress 5.7.10
5.7.7
Fixed in WordPress 5.7.10
5.7.6
Fixed in WordPress 5.7.10
5.7.5
Fixed in WordPress 5.7.10
5.7.4
Fixed in WordPress 5.7.10
5.7.3
Fixed in WordPress 5.7.10
5.7.2
Fixed in WordPress 5.7.10
5.7.1
Fixed in WordPress 5.7.10
5.7
Fixed in WordPress 5.7.10
5.6.11
Fixed in WordPress 5.6.12
5.6.10
Fixed in WordPress 5.6.12
5.6.9
Fixed in WordPress 5.6.12
5.6.8
Fixed in WordPress 5.6.12
5.6.7
Fixed in WordPress 5.6.12
5.6.6
Fixed in WordPress 5.6.12
5.6.5
Fixed in WordPress 5.6.12
5.6.4
Fixed in WordPress 5.6.12
5.6.3
Fixed in WordPress 5.6.12
5.6.2
Fixed in WordPress 5.6.12
5.6.1
Fixed in WordPress 5.6.12
5.6
Fixed in WordPress 5.6.12

References

URL
https://wordpress.org/news/2023/10/wordpress-6-3-2-maintenance-and-security-release/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
mascara7784
Verified
No
WPVDB ID
da1419cc-d821-42d6-b648-bdb3c70d91f2

Timeline

Publicly Published
2023-10-12 (about 7 months ago)
Added
2023-10-13 (about 6 months ago)
Last Updated
2023-10-13 (about 6 months ago)

Other

Published
Title
Published
2021-05-26
Title
Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
Published
2023-11-06
Title
Woocommerce Vietnam Checkout < 2.0.6 - Unauthenticated Stored XSS
Published
2024-02-14
Title
WP SMS < 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2021-08-06
Title
WP Fusion Lite < 3.37.30 - Reflected Cross-Site Scripting (XSS)
Published
2024-02-14
Title
Custom Field Template < 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via $search_label