CVE-2023-38000

MEDIUM EPSS 51.6%

Published Oct 13, 20232y ago · Modified Jun 17, 20262w ago

5.4 CVSS 3.1

Medium

Published Oct 13, 2023 2y ago

Last Modified Jun 17, 2026 2w ago

Description

Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

CVSS Details

Base Score

5.4

Exploitability

2.3

Impact

2.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction Required

Scope Changed

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

51.6% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 6

Vendor	Product	Version	Range
wordpress	wordpress	*	≥5.9 – ≤5.9.7
wordpress	wordpress	*	≥6.0 – ≤6.0.5
wordpress	wordpress	*	≥6.1 – ≤6.1.3
wordpress	wordpress	*	≥6.2 – ≤6.2.2
wordpress	wordpress	*	≥6.3 – ≤6.3.1
wordpress	gutenberg	*	≤16.8.0

References 3

patchstack.com https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve

ExploitThird Party Advisory
patchstack.com https://patchstack.com/database/vulnerability/gutenberg/wordpress-gutenberg-plugin-16-8-0-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve

Third Party Advisory
patchstack.com https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-3-2-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.