Vulnerability · Published Sep 9, 2021 · Assigned by GitHub_M

CVE-2021-39202WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget

High 7.6

In plain English

A high-severity cross-site scripting in wordpress-develop from WordPress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.8%top 42.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	wordpress	no fix listed	UBUNTU-CVE-2021-39202
Ubuntu:24.04:LTS	wordpress	no fix listed	UBUNTU-CVE-2021-39202
Ubuntu:25.10	wordpress	no fix listed	UBUNTU-CVE-2021-39202
Ubuntu:26.04:LTS	wordpress	no fix listed	UBUNTU-CVE-2021-39202
Ubuntu:26.10	wordpress	no fix listed	UBUNTU-CVE-2021-39202

Affected products (as reported)

Vendor	Product	Versions
WordPress	wordpress-develop	5.8 beta 15.8 beta 2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fr6h-3855-j297 x_refsource_CONFIRM
https://hackerone.com/reports/1222797 x_refsource_MISC