CVE-2022-21662: WordPress core stored XSS by low-privileged authenticated users

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS rates it medium (5.4) and it requires an authenticated low-privileged account plus victim interaction, though the high EPSS percentile and privileged-victim target raise concern.

What it is

WordPress core allows low-privileged authenticated users such as authors to store JavaScript that executes in the browser of higher-privileged users, a stored cross-site scripting flaw (CWE-79). It matters because a low-trust account can reach administrative sessions, and the vendor states there are no known workarounds. The issue is patched in WordPress 5.8.3, with backports to 3.7.37 and later security releases.

Impact

An attacker with a low-privileged account can run script in a higher-privileged user's session, enabling session or data theft and actions performed as that user. The CVSS vector rates scope changed with low confidentiality and integrity impact, so full site takeover is not guaranteed by the record alone.

Attack surface

Reached over the network through WordPress content handling; the attacker needs an authenticated low-privileged account, and a higher-privileged user must view the crafted content, so user interaction is required. No unauthenticated path is described.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is high at 0.64529 (99.2nd percentile), indicating elevated likelihood of exploitation activity. The record does not confirm public exploit availability.

What to do

• Update WordPress core to 5.8.3 or later; for older branches apply the corresponding security release back to 3.7.37.
• Keep WordPress auto-updates enabled as the vendor recommends, since no workaround exists.
• Update packaged WordPress on Debian and Fedora systems per DSA-5039 and the Fedora package announcements.
• Reduce the number of author-level and similar low-privileged accounts and review their capabilities.
• Apply output encoding and content sanitization controls on any custom code that renders user-supplied content.

Detection

• Review posts, comments and other stored content created by low-privileged accounts for injected script or unexpected HTML.
• Monitor web logs for requests containing script payloads in parameters tied to content creation or editing.
• Alert on administrative sessions that follow recent views of content authored by low-privileged users.
• Check WordPress version reporting across the estate to find hosts still below 5.8.3 or unpatched backport levels.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.