CVE-2022-43500
MEDIUM
6.1
CVSS Score
Published: December 5, 2022 at 12:00 AM UTC
Updated: June 17, 2026 at 05:06 AM UTC
2 products affected across 2 vendorsWordPressWordPress
Using WordPress by WordPress.org?
Get instant alerts when new vulnerabilities affect WordPress - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.1
Exploit prediction
EPSS 1.0%
SSVC
No known exploit
Description
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
WordPress· WordPressdrupal
95%v < 3.7.403.8 ≤ v < 3.8.403.9 ≤ v < 3.9.394.0 ≤ v < 4.0.374.1 ≤ v < 4.1.374.2 ≤ v < 4.2.344.3 ≤ v < 4.3.304.4 ≤ v < 4.4.294.5 ≤ v < 4.5.284.6 ≤ v < 4.6.254.7 ≤ v < 4.7.254.8 ≤ v < 4.8.214.9 ≤ v < 4.9.225.0 ≤ v < 5.0.185.1 ≤ v < 5.1.155.2 ≤ v < 5.2.175.3 ≤ v < 5.3.145.4 ≤ v < 5.4.125.5 ≤ v < 5.5.115.6 ≤ v < 5.6.105.7 ≤ v < 5.7.85.8 ≤ v < 5.8.65.9 ≤ v < 5.9.56.0 ≤ v < 6.0.3
Affected range stops below 3.7.40, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.8.40, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.9.39, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.0.37, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.1.37, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.2.34, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.3.30, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.4.29, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.5.28, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.6.25, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.7.25, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.8.21, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.9.22, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.0.18, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.1.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.2.17, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.3.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.4.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.5.11, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.6.10, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.7.8, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.8.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.9.5, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.0.3, so it looks safe — our inference, not a vendor statement
v < 6.0.3
Affected range stops below 6.0.3, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (3)
PatchRelease NotesVendor Advisory
Source: [email protected]
https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/SSVC — Action Prioritization
SSVCNo known exploitNot automatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
6.1MEDIUMCISA-ADP
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-79
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card