CVE-2022-4973 WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function

Q: What is CVE-2022-4973?

CVE-2022-4973 is a medium-severity cross-site scripting vulnerability in Wordpress Wordpress, published on 16 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Q: Which versions are affected by CVE-2022-4973?

2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 1 product.

Q: Is CVE-2022-4973 being exploited?

There is no known exploitation of CVE-2022-4973 in the wild and no public exploit code.

Q: How do I fix CVE-2022-4973?

Upgrade wordpress to a fixed version for your release line: 3.6.2, 3.7.39, 3.8.39 or 3.9.37.

Medium 4.9 Published 16 Oct 2024 Updated 8 Apr 2026

Authenticated users can inject scripts into posts via the_meta function, leading to stored XSS execution on affected pages.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-4973?

CVE-2022-4973 is a medium-severity cross-site scripting vulnerability in Wordpress Wordpress, published on 16 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.

Weakness: CWE-79

Which versions are affected by CVE-2022-4973?

2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 1 product.

Package	Affected	Fixed in
`wordpress` Bitnami	All versions	`3.6.2, 3.7.39, 3.8.39, 3.9.37, 4.0.36, 4.1.36, 4.2.33, 4.3.29, 4.4.28, 4.5.27, 4.6.24, 4.7.24, 4.8.20, 4.9.21, 5.0.17, 5.1.14, 5.2.16, 5.3.13, 5.4.11, 5.5.10, 5.6.9, 5.7.7, 5.8.5, 5.9.4, 6.0.2`
`wordpress-multisite` Bitnami	All versions	`3.6.2, 3.7.39, 3.8.39, 3.9.37, 4.0.36, 4.1.36, 4.2.33, 4.3.29, 4.4.28, 4.5.27, 4.6.24, 4.7.24, 4.8.20, 4.9.21, 5.0.17, 5.1.14, 5.2.16, 5.3.13, 5.4.11, 5.5.10, 5.6.9, 5.7.7, 5.8.5, 5.9.4, 6.0.2`

Products include Wordpress Wordpress.

How do I fix CVE-2022-4973?

Upgrade wordpress to a fixed version for your release line: 3.6.2, 3.7.39, 3.8.39 or 3.9.37.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-4973 being exploited?

There is no known exploitation of CVE-2022-4973 in the wild and no public exploit code.

All Wordpress Wordpress vulnerabilities

Sources

Also known as BIT-wordpress-2022-4973, BIT-wordpress-multisite-2022-4973, DEBIAN-CVE-2022-4973, GHSA-mhf3-8588-hqc6, UBUNTU-CVE-2022-4973.