title: Authenticated cross-site scripting (XSS) in WordPress Customizer
description: In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
problem types: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
product: WordPress
vendor: WordPress
versions:
status: affected, version: >= 5.4.0, < 5.4.1
status: affected, version: >= 5.3.0, < 5.3.3
status: affected, version: >= 5.2.0, < 5.2.6
status: affected, version: >= 5.1.0, < 5.1.5
status: affected, version: >= 5.0.0, < 5.0.9
status: affected, version: >= 4.9.0, < 4.9.14
status: affected, version: >= 4.8.0, < 4.8.13
status: affected, version: >= 4.7.0, < 4.7.17
status: affected, version: >= 4.6.0, < 4.6.18
status: affected, version: >= 4.5.0, < 4.5.21
status: affected, version: >= 4.4.0, < 4.4.22
status: affected, version: >= 4.3.0, < 4.3.23
status: affected, version: >= 4.2.0, < 4.2.27
status: affected, version: >= 4.1.0, < 4.1.30
status: affected, version: >= 4.0.0, < 4.0.30
status: affected, version: >= 3.9.0, < 3.9.31
status: affected, version: >= 3.8.0, < 3.8.33
status: affected, version: >= 3.7.0, < 3.7.33
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
]