Authenticated XSS via media attachment page in WordPress

6.8 CVSS

Vulnerability Description

In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-4047

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from WordPress

View All →

CVE-2025-58674

WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

Medium 5.9

CVE-2025-58246

WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Medium 4.3

CVE-2025-54352

WordPress 3.5 through 6.8.2 allows remote attackers to guess titles...

Low 3.7

CVE-2024-31211

Remote Code Execution in `WP_HTML_Token`

Medium 5.5

CVE-2024-31210

PHP file upload bypass via Plugin installer

High 7.7

Affected Vendor

WordPress

View all reports →

Affected Software

wordpress-develop

Vulnerable Versions:

>= 5.4.0, < 5.4.2, >= 5.3.0, < 5.3.4, >= 5.2.0, < 5.2.7, >= 5.1.0, < 5.1.6, >= 5.0.0, < 5.0.10, >= 4.9.0, < 4.9.15, >= 4.8.0, < 4.8.14, >= 4.7.0, < 4.7.18, >= 4.6.0, < 4.6.19, >= 4.5.0, < 4.5.22, >= 4.4.0, < 4.4.23, >= 4.3.0, < 4.3.24, >= 4.2.0, < 4.2.28, >= 4.1.0, < 4.1.31, >= 4.0.0, < 4.0.31, >= 3.9.0, < 3.9.32, >= 3.8.0, < 3.8.34, >= 3.7.0, < 3.7.34