A user with Contributor access or higher can put HTML into the label of a Comments Pagination Next/Previous or Post Navigation Link block. The blocks’ server-side render callbacks printed the label without escaping, so the markup ends up in the page served to every visitor. Fixed upstream in WordPress 7.1.4 and the matching security releases of the 5.9-7.0 branches.
This vulnerability affects the following application versions:
- WordPress 5.9
- WordPress 5.9.1
- WordPress 5.9.2
- WordPress 5.9.3
- WordPress 5.9.4
- WordPress 5.9.5
- WordPress 5.9.6
- WordPress 5.9.7
- WordPress 5.9.8
- WordPress 5.9.9
- WordPress 5.9.10
- WordPress 5.9.11
- WordPress 5.9.12
- WordPress 5.9.13
- WordPress 5.9.14
- WordPress 5.9.15
- WordPress 5.9.16
- WordPress 5.9.17
- WordPress 5.9.18
- WordPress 5.9.19
- WordPress 6.0
- WordPress 6.0.1
- WordPress 6.0.2
- WordPress 6.0.3
- WordPress 6.0.4
- WordPress 6.0.5
- WordPress 6.0.6
- WordPress 6.0.7
- WordPress 6.0.8
- WordPress 6.0.9
- WordPress 6.0.10
- WordPress 6.0.11
- WordPress 6.0.12
- WordPress 6.0.13
- WordPress 6.0.14
- WordPress 6.0.15
- WordPress 6.0.16
- WordPress 6.0.17
- WordPress 6.1
- WordPress 6.1.1
- WordPress 6.1.2
- WordPress 6.1.3
- WordPress 6.1.4
- WordPress 6.1.5
- WordPress 6.1.6
- WordPress 6.1.7
- WordPress 6.1.8
- WordPress 6.1.9
- WordPress 6.1.10
- WordPress 6.1.11
- WordPress 6.1.12
- WordPress 6.1.13
- WordPress 6.1.14
- WordPress 6.1.15
- WordPress 6.2
- WordPress 6.2.1
- WordPress 6.2.2
- WordPress 6.2.3
- WordPress 6.2.4
- WordPress 6.2.5
- WordPress 6.2.6
- WordPress 6.2.7
- WordPress 6.2.8
- WordPress 6.2.9
- WordPress 6.2.10
- WordPress 6.2.11
- WordPress 6.2.12
- WordPress 6.2.13
- WordPress 6.2.14
- WordPress 6.3
- WordPress 6.3.1
- WordPress 6.3.2
- WordPress 6.3.3
- WordPress 6.3.4
- WordPress 6.3.5
- WordPress 6.3.6
- WordPress 6.3.7
- WordPress 6.3.8
- WordPress 6.3.9
- WordPress 6.3.10
- WordPress 6.3.11
- WordPress 6.3.12
- WordPress 6.3.13
- WordPress 6.4
- WordPress 6.4.1
- WordPress 6.4.2
- WordPress 6.4.3
- WordPress 6.4.4
- WordPress 6.4.5
- WordPress 6.4.6
- WordPress 6.4.7
- WordPress 6.4.8
- WordPress 6.4.9
- WordPress 6.4.10
- WordPress 6.4.11
- WordPress 6.4.12
- WordPress 6.4.13
- WordPress 6.5
- WordPress 6.5.2
- WordPress 6.5.3
- WordPress 6.5.4
- WordPress 6.5.5
- WordPress 6.5.6
- WordPress 6.5.7
- WordPress 6.5.8
- WordPress 6.5.9
- WordPress 6.5.10
- WordPress 6.5.11
- WordPress 6.5.12
- WordPress 6.5.13
- WordPress 6.6
- WordPress 6.6.1
- WordPress 6.6.2
- WordPress 6.6.3
- WordPress 6.6.4
- WordPress 6.6.5
- WordPress 6.6.6
- WordPress 6.6.7
- WordPress 6.6.8
- WordPress 6.6.9
- WordPress 6.6.10
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.7.5
- WordPress 6.7.6
- WordPress 6.7.7
- WordPress 6.7.8
- WordPress 6.7.9
- WordPress 6.7.10
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.8.4
- WordPress 6.8.5
- WordPress 6.8.6
- WordPress 6.8.7
- WordPress 6.8.8
- WordPress 6.8.9
- WordPress 6.8.10
- WordPress 6.8.11
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 6.9.6
- WordPress 6.9.7
- WordPress 6.9.8
- WordPress 6.9.9
- WordPress 6.9.10
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2
- WordPress 7.0.3
- WordPress 7.0.4
- WordPress 7.0.5
- WordPress 7.0.6
- WordPress 7.0.7
- WordPress 7.1
- WordPress 7.1.1
- WordPress 7.1.2
- WordPress 7.1.3