cve/cves/2020/CVE-2020-4046.md at main - cve - 临风笛

admin/cve

0 Fork 0

mirror of https://github.com/0xMarcio/cve.git synced 2026-10-27 16:51:03 +00:00

Files

T

0xMarcio 82ab6a1c19 Fix PoC discovery, freshness and source validation

2026-10-06 23:23:48 +02:00

3.1 KiB

Raw Permalink Blame History

CVE-2020-4046

Authenticated XSS through embed block in WordPress

Description

In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

POC

Reference

No PoCs from references.

Github

No PoCs found on GitHub currently.