CVE-2022-21662

Deeper analysis

WordPress core contains a stored cross-site scripting vulnerability tracked as CVE-2022-21662. Low-privileged authenticated users, such as those with the Author role, can inject JavaScript that executes in the context of higher-privileged accounts when the malicious content is later viewed. The flaw affects all WordPress releases prior to 5.8.3 and was also back-ported to older branches as far as 3.7.37; the corresponding CWE is 79 and the CVSS 3.1 base score is 8.0.

An attacker who already possesses a low-privileged account can craft and publish content that stores executable script. When an administrator or editor subsequently views the affected post, page, or dashboard element, the script runs with that user’s elevated rights, enabling actions such as account takeover, plugin installation, or data exfiltration. The attack requires user interaction and a non-trivial level of complexity, reflected in the CVSS vector AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.

Official advisories from the WordPress project, Debian, and Fedora state that the issue is resolved in version 5.8.3 and the corresponding security releases for older branches. Administrators are strongly encouraged to enable automatic updates; no workarounds are available.

EPSS for the CVE reached a peak of 0.2089 after disclosure before settling at the current value of 0.1424, indicating a measurable increase in observed exploitation interest following public release.