CVE-2022-21662 Stored XSS in WordPress

High 8.0 Published 6 Jan 2022 Updated 23 Apr 2025

Low-privileged users can inject JavaScript to execute code or escalate privileges against high-privileged users in WordPress.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-21662?

CVE-2022-21662 is a high-severity cross-site scripting vulnerability in Debian Debian Linux, published on 6 Jan 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.

Weakness: CWE-79

Which versions are affected by CVE-2022-21662?

2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 2 products.

Package	Affected	Fixed in
`wordpress` Bitnami	All versions	`5.8.3`
`wordpress-multisite` Bitnami	All versions	`5.8.3`

Products include Debian Debian Linux, Wordpress Wordpress.

How do I fix CVE-2022-21662?

Upgrade wordpress to 5.8.3 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-21662 being exploited?

There is no known exploitation of CVE-2022-21662 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as BIT-wordpress-2022-21662, BIT-wordpress-multisite-2022-21662, DEBIAN-CVE-2022-21662, GHSA-699q-3hj9-889w, UBUNTU-CVE-2022-21662.