CVE-2022-43500
MEDIUM
Published Dec 5, 20223y ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Published Dec 5, 2022 3y ago
Last Modified Jun 17, 2026 2w ago
Description
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 24
| Vendor | Product | Version | Range |
|---|---|---|---|
| wordpress | wordpress | * | <3.7.40 |
| wordpress | wordpress | * | ≥3.8 – <3.8.40 |
| wordpress | wordpress | * | ≥3.9 – <3.9.39 |
| wordpress | wordpress | * | ≥4.0 – <4.0.37 |
| wordpress | wordpress | * | ≥4.1 – <4.1.37 |
| wordpress | wordpress | * | ≥4.2 – <4.2.34 |
| wordpress | wordpress | * | ≥4.3 – <4.3.30 |
| wordpress | wordpress | * | ≥4.4 – <4.4.29 |
| wordpress | wordpress | * | ≥4.5 – <4.5.28 |
| wordpress | wordpress | * | ≥4.6 – <4.6.25 |
| wordpress | wordpress | * | ≥4.7 – <4.7.25 |
| wordpress | wordpress | * | ≥4.8 – <4.8.21 |
| wordpress | wordpress | * | ≥4.9 – <4.9.22 |
| wordpress | wordpress | * | ≥5.0 – <5.0.18 |
| wordpress | wordpress | * | ≥5.1 – <5.1.15 |
| wordpress | wordpress | * | ≥5.2 – <5.2.17 |
| wordpress | wordpress | * | ≥5.3 – <5.3.14 |
| wordpress | wordpress | * | ≥5.4 – <5.4.12 |
| wordpress | wordpress | * | ≥5.5 – <5.5.11 |
| wordpress | wordpress | * | ≥5.6 – <5.6.10 |
| wordpress | wordpress | * | ≥5.7 – <5.7.8 |
| wordpress | wordpress | * | ≥5.8 – <5.8.6 |
| wordpress | wordpress | * | ≥5.9 – <5.9.5 |
| wordpress | wordpress | * | ≥6.0 – <6.0.3 |
References 3
- jvn.jp https://jvn.jp/en/jp/JVN09409909/index.html
- wordpress.org https://wordpress.org/download/
- wordpress.org https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/
Remediation
- wordpress.org https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/