title: Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block
description: Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
defaultStatus: unaffected
product: WordPress
vendor: WordPress.org
versions:
changes: [at: 6.3.2, status: unaffected], lessThanOrEqual: 6.3.1, status: affected, version: 6.3, versionType: custom
changes: [at: 6.2.3, status: unaffected], lessThanOrEqual: 6.2.2, status: affected, version: 6.2, versionType: custom
changes: [at: 6.1.4, status: unaffected], lessThanOrEqual: 6.1.3, status: affected, version: 6.1, versionType: custom
changes: [at: 6.0.6, status: unaffected], lessThanOrEqual: 6.0.5, status: affected, version: 6.0, versionType: custom
changes: [at: 5.9.8, status: unaffected], lessThanOrEqual: 5.9.7, status: affected, version: 5.9, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: gutenberg
product: Gutenberg
vendor: Gutenberg Team
versions:
changes: [at: 16.8.1, status: unaffected], lessThanOrEqual: 16.8.0, status: affected, version: n/a, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update WordPress core to the 6.3.2, 6.2.3, 6.1.4, 6.0.6, 5.9.8 or a higher version.