Security

WordPress Block Editor could let even most basic users exploit XSS vulns!

 

WordPress 5.4.2 release announcement stated the update shipped with multiple fixes for Cross-Site Scripting (XSS) vulnerabilities. Out of this the most significant fix is the one resolving, “an XSS issue where authenticated users with low privileges are able to add JavaScript to posts in the block editor.

Sam Thomas (jazzy2fives) has been credited with discovery of this particular XSS vulnerability.

Starting in versions 5.x, WordPress introduced a “block editor” which attempts to mimic modern editor, as offered by sites like Medium. The editor with its sleek design appears to be more lightweight than its predecessor Classic Editor that has shipped with WordPress versions.

The XSS flaw in this newer editor meant that authenticated users with even the lowest level of access to the editor, such as contributors, could inject malicious JavaScript in a post. The post when loaded by the user would execute seamlessly and cause Cross-Site Scripting (XSS) attacks.

Unlike WordPress vulns. we hear about these days which impact various plugins, this one is in the Core platform itself, prompting an urgent need for users to patch their installations!

The advisory additionally mentions other security updates along with crediting those who reported these vulnerabilities:

Security Updates

WordPress versions 5.4 and earlier are affected by the following bugs, which are fixed in version 5.4.2. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.

  • Props to Sam Thomas (jazzy2fives) for finding an XSS issue where authenticated users with low privileges are able to add JavaScript to posts in the block editor.
  • Props to Luigi – (gubello.me) for discovering an XSS issue where authenticated users with upload permissions are able to add JavaScript to media files.
  • Props to Ben Bidner of the WordPress Security Team for finding an open redirect issue in wp_validate_redirect().
  • Props to Nrimo Ing Pandum for finding an authenticated XSS issue via theme uploads.
  • Props to Simon Scannell of RIPS Technologies for finding an issue where set-screen-option can be misused by plugins leading to privilege escalation.
  • Props to Carolina Nymark for discovering an issue where comments from password-protected posts and pages could be displayed under certain conditions.

Users are advised to update their WordPress installations. Should automatic updates be not enabled, WordPress 5.4.2 can be downloaded by navigating to your website’s Admin Dashboard and navigating to Updates Update Now.

Ax Sharma

Ax Sharma is a UK-based security researcher, journalist and TV subject matter expert experienced in malware analysis and cybercrime investigations. His areas of interest include open source software security and threat intel analysis. Frequently featured by leading media outlets like the BBC, Channel 5, Fortune, WIRED, The Register, among others, Ax is an active community member of the OWASP Foundation and the British Association of Journalists (BAJ).

Recent Posts

ParkMobile’s $32.8 Million Data Breach Settlement = You get $1?

In 2021, parking app ParkMobile suffered a massive data breach impacting 22 million users whose…

10 hours ago

8 Brutal Truths About Cybersecurity I Wish I Knew

When I first got into cybersecurity, I thought it was all about hackers in hoodies…

2 days ago

US Air Force Probes Potential SharePoint-Linked Privacy Breach

The US Air Force is investigating a “privacy-related issue” that may have exposed personally identifiable…

3 days ago

Harrods third-party breach exposes 430,000 customer records, hackers reach out

London’s iconic department store Harrods has disclosed that approximately 430,000 customer records were compromised in…

5 days ago

WestJet confirms customer ID, passports stolen in June cyberattack

WestJet confirmed that in a June 2025 cybersecurity incident, a “sophisticated, criminal third party” gained…

5 days ago

Did You Also Get a ‘Real’ Phishing Email From GitHub.com?

Imagine getting an email straight from GitHub’s own notification system: the same one you've trusted…

1 week ago

This website uses cookies.