medium5.4Public exploit code
CVE-2019-16223
WordPress before 5.2.3 allows XSS in post previews by authenticated users.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Wordpress Core 5.2.2 - 'post previews' XSS2021-01-04 · webapps · php
Impact
WordPress before 5.2.3 allows XSS in post previews by authenticated users.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wordpress | Wordpress | before 5.2.3 |
| Debian | Debian Linux | Versions 8.0, 9.0, 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/160745/WordPress-Core-5.2.2-Cross-Site-Scripting.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html
- https://seclists.org/bugtraq/2020/Jan/8
- https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/
- https://wpvulndb.com/vulnerabilities/9862
- https://www.debian.org/security/2020/dsa-4599
- https://www.debian.org/security/2020/dsa-4677
- http://packetstormsecurity.com/files/160745/WordPress-Core-5.2.2-Cross-Site-Scripting.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html
- https://seclists.org/bugtraq/2020/Jan/8
- https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/
- https://wpvulndb.com/vulnerabilities/9862
- https://www.debian.org/security/2020/dsa-4599
- https://www.debian.org/security/2020/dsa-4677