In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Multiple vulnerabilities were discovered in Wordpress, a popular content management framework.

CVE-2019-17670

WordPress has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.

CVE-2020-4047

Authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them.

CVE-2020-4048

Due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked.

CVE-2020-4049

When uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page.

CVE-2020-4050

Misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users.

Additionally, this upload ensures latest comments can only be viewed from public posts, and fixes back the user activation procedure.

For Debian 9 stretch, these problems have been fixed in version 4.7.18+dfsg-1+deb9u1.

We recommend that you upgrade your wordpress packages.

For the detailed security status of wordpress please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/wordpress

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) attacks, create open redirects, escalate privileges, and bypass authorization access.

CVE-2020-4046

In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin.

CVE-2020-4047

In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them.

CVE-2020-4048

In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked.

CVE-2020-4049

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS.

CVE-2020-4050

In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved.
It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users.

For Debian 8 'Jessie', these problems have been fixed in version 4.1.31+dfsg-0+deb8u1.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - A cross-site scripting (XSS) vulnerability exist in the block editor.

 - A cross-site scripting (XSS) vulnerability exist in media files.

 - An open redirect vulnerability exists in wp_validate_redirect().

 - A cross-site scripting (XSS) vulnerability exist in theme uploads.

 - A privilege escalation vulnerability exists in set-screen-option.

 - An authorization bypass vulnerability exists in password-protected posts and pages.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) attacks, create open redirects, escalate privileges, and bypass authorization access.

**WordPress 5.4.2 Security and Maintenance Release**

This security and maintenance release features 23 fixes and enhancements. Plus, it adds a number of security fixes&mdash;see the list below.

These bugs affect WordPress versions 5.4.1 and earlier; version 5.4.2 fixes them, so you&rsquo;ll want to upgrade.

**Security Updates**

WordPress versions 5.4 and earlier are affected by the following bugs, which are fixed in version 5.4.2. If you haven&rsquo;t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.

  - Props to Sam Thomas (jazzy2fives) for finding an XSS     issue where authenticated users with low privileges are     able to add JavaScript to posts in the block editor.

  - Props to Luigi &ndash; (gubello.me) for discovering an     XSS issue where authenticated users with upload     permissions are able to add JavaScript to media files.

  - Props to Ben Bidner of the WordPress Security Team for     finding an open redirect issue in     wp_validate_redirect().

  - Props to Nrimo Ing Pandum for finding an authenticated     XSS issue via theme uploads.

  - Props to Simon Scannell of RIPS Technologies for finding     an issue where set-screen-option can be misused by     plugins leading to privilege escalation.

  - Props to Carolina Nymark for discovering an issue where     comments from password-protected posts and pages could     be displayed under certain conditions.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the installation of WordPress installed on the remote host is affected   by multiple vulnerabilities: 
    - Multiple cross-site scripting (XSS) vulnerabilities exist in Wordpress due to improper validation of       user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these       , by convincing a user to click a specially crafted URL, to execute arbitrary script code in       a user's browser session (CVE-2020-4047, CVE-2020-4049).

    - An open-redirect vulnerability exists in Wordpress due to insufficient validation of user-supplied input.
      An unauthenticated, remote attack can exploit this to redirect users to potentially malicious sites       (CVE-2020-4048).
   Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported   version

ID	Name	Product	Family	Severity
140539	Debian DLA-2371-1 : wordpress security update	Nessus	Debian Local Security Checks	critical
138062	Debian DLA-2269-1 : wordpress security update	Nessus	Debian Local Security Checks	medium
112479	WordPress 5.4.x < 5.4.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112478	WordPress 5.3.x < 5.3.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112477	WordPress 5.2.x < 5.2.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112475	WordPress 5.1.x < 5.1.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112474	WordPress 5.0.x < 5.0.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112473	WordPress 4.9.x < 4.9.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112472	WordPress 4.8.x < 4.8.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112471	WordPress 4.7.x < 4.7.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112469	WordPress 4.6.x < 4.6.19 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112468	WordPress 4.5.x < 4.5.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112467	WordPress 4.4.x < 4.4.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112466	WordPress 4.3.x < 4.3.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112465	WordPress 4.2.x < 4.2.28 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112464	WordPress 4.1.x < 4.1.31 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112463	WordPress 4.0.x < 4.0.31 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112462	WordPress 3.9.x < 3.9.32 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112460	WordPress 3.8.x < 3.8.34 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
112459	WordPress 3.7.x < 3.7.34 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
137764	Debian DSA-4709-1 : wordpress - security update	Nessus	Debian Local Security Checks	medium
137735	Fedora 31 : wordpress (2020-bbedd29391)	Nessus	Fedora Local Security Checks	medium
137734	Fedora 32 : wordpress (2020-8447a3e195)	Nessus	Fedora Local Security Checks	medium
137627	WordPress < 5.4.2	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2020-4047

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium