CVE-2022-33994

low-risk
Published 2022-07-30

The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators.

Do I need to act?

-
0.29% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.0/10 Low
NETWORK / HIGH complexity

Affected Products (1)

Gutenberg

Affected Vendors

Gutenberg Project

References (4)

Third Party Advisory https://blog.jitendrapatro.me/cve-2022-33994-stored-xss-in-wordpress/
Exploit https://patchstack.com/articles/patchstack-weekly-svg-xss-reported-in-gutenberg/
Third Party Advisory https://blog.jitendrapatro.me/cve-2022-33994-stored-xss-in-wordpress/
Exploit https://patchstack.com/articles/patchstack-weekly-svg-xss-reported-in-gutenberg/
17
/ 100
low-risk
Severity 11/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal