WordPress has announced the 6.5.2 Maintenance and Security Release update, addressing a stored cross site scripting vulnerability and fixing over a dozen bugs in the core and the block editor.
This vulnerability impacts both the WordPress core and the Gutenberg plugin.
Cross Site Scripting (XSS)
An XSS vulnerability discovered in WordPress could allow an attacker to inject scripts into a website, potentially attacking visitors to those pages.
There are different types of XSS vulnerabilities, but the most commonly discovered in WordPress plugins, themes, and WordPress itself, are reflected XSS and stored XSS.
Reflected XSS requires a victim to click a link, making this kind of attack more challenging to launch. Stored XSS, on the other hand, is more alarming because it exploits a flaw that allows the attacker to upload a script into the vulnerable site, which can then launch attacks against site visitors. The vulnerability found in WordPress is a stored XSS.
The threat is somewhat mitigated because this is an authenticated stored XSS, meaning the attacker needs to have at least contributor-level permissions to exploit the website flaw that makes the vulnerability possible.
This vulnerability is rated as a medium-level threat, receiving a Common Vulnerability Scoring System (CVSS) score of 6.4 on a scale of 1 to 10.
Wordfence describes the vulnerability:
“WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”
WordPress Recommends Updating Immediately
The official WordPress announcement recommends users update their installations immediately:
“Because this is a security release, it is recommended that you update your sites immediately. Backports are also available for other major WordPress releases, 6.1 and later.”
Wordfence Advisories
- WordPress Core < 6.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
- Gutenberg 12.9.0 – 18.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
Official WordPress Announcement
- WordPress 6.5.2 Maintenance and Security Release
Featured Image by Shutterstock/ivan_kislitsin
