7.6

CVE-2021-39201: debian debian_linux Cross-site Scripting

CVSS: 7.6v3.1HighModified
AliasesUBUNTU-CVE-2021-39201DEBIAN-CVE-2021-39201DSA-4985-1
Published 09-09-2021Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2021-39201 is a high (CVSS 7.6) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.9% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.6/10
010
High · v3.1 (CVE.org)
EPSS score
1.49%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 09-09-2021
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

1.49%

Chance of exploitation in the next 30 days

Percentile

74%

Versus all other CVEs

30-day change

0.00 pp

From 1.49% on 21-09-2026

21-09-202621-10-2026
EPSS score
1.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Wordpress3 products
  • wordpress≥ 5.4, < 5.4.7 | ≥ 5.5, < 5.5.6 (fixed in 5.4.7) | ≥ 5.6, < 5.6.5 (fixed in 5.4.7) | ≥ 5.7, < 5.7.3 (fixed in 5.4.7) | ≥ 5.8, < 5.8.1 (fixed in 5.4.7)
  • wordpress≥ 5.0, < 5.8
  • wordpress-develop≥ 5.0, < 5.8.0
Debian2 products
  • wordpress< 5.8.1+dfsg1-1 | < 5.0.14+dfsg1-0+deb10u1 | < 5.7.3+dfsg1-0+deb11u1
  • debian_linuxEOL10.0 | 11.0
Ubuntu1 product
  • wordpressAll versions (No fix recorded)

3 vendors · 6 products

References

7 links