WordPress < 5.4.2 - Authenticated Stored XSS via Theme Upload

An authenticated user could upload a purposely broken theme and then change the theme's directory name with a Cross-Site Scripting (XSS) payload. When WordPress warns the user about the broken theme, the XSS payload is then executed.

This vulnerability would be difficult to exploit by an attacker in the real world, as the attacker would need to be able to upload themes and be able to modify directory names on the server.

One possible attack scenario is an attacker social engineering a victim to perform these actions, which is very unlikely.