CVE-2022-43500: WordPress

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.

Affected products

• WordPress WordPress: before 3.7.40 (fixed in 3.7.40); from 3.8, before 3.8.40 (fixed in 3.8.40); from 3.9, before 3.9.39 (fixed in 3.9.39); from 4.0, before 4.0.37 (fixed in 4.0.37); from 4.1, before 4.1.37 (fixed in 4.1.37); from 4.2, before 4.2.34 (fixed in 4.2.34); …

Published 2022-12-05. Last modified 2026-06-17.