WordPress component: Cross-site scripting

WordPress component is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

CVE / CNA score 5.4 CVSS 3.1 · security@wordfence.com

NVD score 6.1 CVSS 3.1 · nvd@nist.gov

Component: WordPress component
Plugin slug: Core
Affected: See vendor advisory
Safe version: See mitigation notes
Published: May 17, 2023
Weakness: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

This CVE was published May 17, 2023 and is one of 45 known issues for WordPress core.

What to do

Patch or disable the affected component.

Update WordPress component to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Patch or disable the affected component.

Technical description

Primary and upstream sources