Bug 2294204 (CVE-2024-6305, CVE-2024-6306, CVE-2024-6307)

Summary:	CVE-2024-6306 CVE-2024-6307 CVE-2024-6305 wordpress: multiple vulnerabilities
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2294206, 2294205
Bug Blocks:

Description Patrick Del Bello 2024-06-25 12:55:21 UTC

WordPress Core is vulnerable to Stored Cross-Site Scripting via the Template Part Block in various versions up to 6.5.5 due to insufficient input sanitization and output escaping on the 'tagName' attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

https://core.trac.wordpress.org/changeset/58471
https://wordpress.org/news/2024/06/wordpress-6-5-5/
https://www.wordfence.com/threat-intel/vulnerabilities/id/2a225ccb-a7dc-4437-bd97-b309d6ae6a47?source=cve

Comment 1 Patrick Del Bello 2024-06-25 12:55:37 UTC

Created wordpress tracking bugs for this issue:

Affects: epel-all [bug 2294206]
Affects: fedora-all [bug 2294205]