Skip to content
Fencer Vulns
high 7.6

CVE-2021-39201 json

Authenticated cross-site scripting (XSS) in WordPress editor

published 2021-09-09 5 y ago modified 2026-09-10 59 d ago also BIT-wordpress-2021-39201 , BIT-wordpress-multisite-2021-39201 , EUVD-2021-25583 , GHSA-wh69-25hr-h94v

cvss
7.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)

Patch / fix

  • bitnami wordpress 5.8.0
  • bitnami wordpress-multisite 5.8.0
  • wordpress wordpress 5.8
  • wordpress Debian 14, Debian 13, Debian 12 5.8.1+dfsg1-1

debian advisories DEBIAN-CVE-2021-39201

Exploit prediction

1.49% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N
OSV 3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami wordpress
>=5.0.0, <5.8.0
5.8.0
bitnami wordpress-multisite
>=5.0.0, <5.8.0
5.8.0

Affected products

  • WordPress wordpress-develop

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of WordPress/wordpress-develop published their own advisory on GitHub. Reviewed sources take precedence over it.