CVE-2022-43500

NameCVE-2022-43500
DescriptionCross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5279-1
Debian Bugs1022575

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wordpress (PTS)bullseye (security), bullseye5.7.11+dfsg1-0+deb11u1fixed
bookworm, bookworm (security)6.1.6+dfsg1-0+deb12u1fixed
sid, trixie6.6.1+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
wordpresssourcebuster5.0.18+dfsg1-0+deb10u1
wordpresssourcebullseye5.7.8+dfsg1-0+deb11u1DSA-5279-1
wordpresssource(unstable)6.0.3+dfsg1-11022575

Notes

https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/

Search for package or bug name: Reporting problems