Log in Start free

Vulnerability · Published Oct 13, 2023 · Assigned by Patchstack

CVE-2023-38000Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block

Medium 6.5

In plain English

A medium-severity cross-site scripting in Gutenberg from Gutenberg Team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.9%top 40.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wordpress6.1.6+dfsg1-0+deb12u1DEBIAN-CVE-2023-38000
Debian:13wordpress6.3.2+dfsg1-1DEBIAN-CVE-2023-38000
Debian:14wordpress6.3.2+dfsg1-1DEBIAN-CVE-2023-38000
Ubuntu:22.04:LTSwordpressno fix listedUBUNTU-CVE-2023-38000
Ubuntu:24.04:LTSwordpressno fix listedUBUNTU-CVE-2023-38000
Ubuntu:25.10wordpressno fix listedUBUNTU-CVE-2023-38000
Ubuntu:26.04:LTSwordpressno fix listedUBUNTU-CVE-2023-38000
Ubuntu:26.10wordpressno fix listedUBUNTU-CVE-2023-38000

Affected products (as reported)

VendorProductVersions
WordPress.org WordPress 6.3 – through 6.3.16.2 – through 6.2.26.1 – through 6.1.36.0 – through 6.0.55.9 – through 5.9.7
Gutenberg Team Gutenberg n/a – through 16.8.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

References