WordPress 6.7 through 7.1.3 built the Categories block’s dropdown markup by concatenating the block’s label attribute into the sprintf() format string. A Contributor could store a Categories block whose label contains printf conversion specifiers (such as %1$s or %2$s), which KSES keeps as plain text; when the block is rendered, sprintf() expands them into the wrapper attributes or the dropdown markup, which contain quotes and tags, breaking out of an HTML attribute and injecting script into every page that shows the block. Version 7.1.4 (and 7.0.8, 6.9.11, 6.8.12, 6.7.11) passes the label as a separate sprintf() argument instead.
This vulnerability affects the following application versions:
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.7.5
- WordPress 6.7.6
- WordPress 6.7.7
- WordPress 6.7.8
- WordPress 6.7.9
- WordPress 6.7.10
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.8.4
- WordPress 6.8.5
- WordPress 6.8.6
- WordPress 6.8.7
- WordPress 6.8.8
- WordPress 6.8.9
- WordPress 6.8.10
- WordPress 6.8.11
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 6.9.6
- WordPress 6.9.7
- WordPress 6.9.8
- WordPress 6.9.9
- WordPress 6.9.10
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2
- WordPress 7.0.3
- WordPress 7.0.4
- WordPress 7.0.5
- WordPress 7.0.6
- WordPress 7.0.7
- WordPress 7.1
- WordPress 7.1.1
- WordPress 7.1.2
- WordPress 7.1.3