WordPress Vulnerabilities

WordPress <= 5.2.3 - Stored XSS in Customizer

Affects WordPress

3.8.1

Fixed in version 3.8.31

3.8

Fixed in version 3.8.31

3.7.1

Fixed in version 3.7.31

3.9

Fixed in version 3.9.29

3.9.1

Fixed in version 3.9.29

3.7

Fixed in version 3.7.31

3.8.2

Fixed in version 3.8.31

3.8.3

Fixed in version 3.8.31

3.9.2

Fixed in version 3.9.29

4.0

Fixed in version 4.0.28

References

CVE

CVE-2019-17674

URL

https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/

URL

https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

Miscellaneous

Original Researcher

Evan Ricafort

Verified

WPVDB ID

d39a7b84-28b9-4916-a2fc-6192ceb6fa56

Timeline

Publicly Published

2019-10-14 (about 3 years ago)

Added

2019-10-15 (about 3 years ago)

Last Updated

2020-09-22 (about 2 years ago)

Our Other Services

WPScan WordPress Security Plugin