6.1Medium

CVE-2022-43500

WordPress.org WordPress Published: 2022-12-05 03:00 (3 years ago)

Description

Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.

Weakness (CWE): CWE-79

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
WordPress.org	WordPress	versions prior to 6.0.3

References and patches

CVSS score

6.1Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS (chance of exploitation in 30 days)

1.01%

higher than 64% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2022-10-22
Published2022-12-05 03:00
Reached IP-DB2026-10-24 23:38
Last updated2025-04-24 17:06

Assigned by (CNA): jpcert

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress (core)

8.1High

CVE-2026-119977 KEV 15 days ago

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

WordPress Foundation WordPress

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the s…

1.2%EPSS

4.9Medium

CVE-2026-114570 24 days ago

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

WordPress Foundation WordPress

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and ab…

8.1High

CVE-2026-87902 KEV 1 month ago

WordPress Core Remote File Inclusion Vulnerability

WordPress WordPress

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

96%EPSS

8.8High

CVE-2026-65640 3 months ago

WordPress WordPress

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This…

1.9%EPSS

8.9High

CVE-2026-64638 3 months ago

WordPress WordPress

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of t…

5.9Medium

CVE-2026-60137 KEV 4 months ago

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

WordPress WordPress

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

5.3%EPSS