CVE-2022-21662 in the critical feed json
Stored XSS in WordPress
published 2022-01-06 4 y ago modified 2026-09-10 59 d ago also BIT-wordpress-2022-21662 , BIT-wordpress-multisite-2022-21662 , EUVD-2022-26879 , GHSA-699q-3hj9-889w
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 64.5%
- EPSS 64.5% chance of exploitation in 30 days, percentile 99.2%
- public exploits
- 0
- none known
Summary
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
Patch / fix
- bitnami wordpress 5.8.3
- bitnami wordpress-multisite 5.8.3
- wordpress wordpress 5.8.3
- wordpress Debian 14, Debian 13, Debian 12 5.8.3+dfsg1-1
debian advisories DEBIAN-CVE-2022-21662
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-21662 updated cvss 8.0
wordpress: stored XSS through authenticated users
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
64.53% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| OSV | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | wordpress | <5.8.3 |
5.8.3 |
| bitnami | wordpress-multisite | <5.8.3 |
5.8.3 |
Affected products
- WordPress wordpress-develop
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
References
-
debian.org
/security/2022/dsa-5039
vendor-advisory, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/
vendor-advisory, web
-
wordpress.org
/news/2022/01/wordpress-5-8-3-security-release/
release-notes, vendor-advisory, advisory
-
github.com
/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889w
third-party-advisory, advisory
-
lists.debian.org
/debian-lts-announce/2022/01/msg00019.html
mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-21662
web
Sources
- CVE List CVE-2022-21662
- NVD CVE-2022-21662
- OSV BIT-wordpress-2022-21662
- OSV BIT-wordpress-multisite-2022-21662
- Maintainer advisory GHSA-699q-3hj9-889w
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of WordPress/wordpress-develop published their own advisory on GitHub. Reviewed sources take precedence over it.