Cross-site scripting (XSS) in Search block in WordPress

6.4 CVSS

Vulnerability Description

In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-11030

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from WordPress

View All →

CVE-2025-58674

WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

Medium 5.9

CVE-2025-58246

WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Medium 4.3

CVE-2025-54352

WordPress 3.5 through 6.8.2 allows remote attackers to guess titles...

Low 3.7

CVE-2024-31211

Remote Code Execution in `WP_HTML_Token`

Medium 5.5

CVE-2024-31210

PHP file upload bypass via Plugin installer

High 7.7

Affected Vendor

WordPress

View all reports →

Affected Software

WordPress

Vulnerable Versions:

>= 5.4.0, < 5.4.1, >= 5.3.0, < 5.3.3, >= 5.2.0, < 5.2.6, >= 5.1.0, < 5.1.5, >= 5.0.0, < 5.0.9, >= 4.9.0, < 4.9.14, >= 4.8.0, < 4.8.13, >= 4.7.0, < 4.7.17, >= 4.6.0, < 4.6.18, >= 4.5.0, < 4.5.21, >= 4.4.0, < 4.4.22, >= 4.3.0, < 4.3.23, >= 4.2.0, < 4.2.27, >= 4.1.0, < 4.1.30, >= 4.0.0, < 4.0.30, >= 3.9.0, < 3.9.31, >= 3.8.0, < 3.8.33, >= 3.7.0, < 3.7.33