IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.5Media

CVE-2023-38000Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block

WordPress.org WordPress; Gutenberg Team Gutenberg Publicada: (hace 3 años)

Descripción

Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Gutenberg Team Gutenberg ≤ 16.8.0
WordPress.org WordPress 6.3 – ≤ 6.3.1, 6.2 – ≤ 6.2.2, 6.1 – ≤ 6.1.3, 6.0 – ≤ 6.0.5, 5.9 – ≤ 5.9.7

Referencias y parches

CVE recientes del mismo producto — WordPress (core)

8.1Alta
CVE-2026-87902 KEV

WordPress Core Remote File Inclusion Vulnerability

WordPress WordPress

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

96%EPSS
8.8Alta
CVE-2026-65640
WordPress WordPress

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This…

1.9%EPSS
8.9Alta
CVE-2026-64638
WordPress WordPress

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of t…