Users with the Contributor role or above could store Interactivity API directives in post content that the client-side runtime processed unsafely: javascript: URLs and on* event-handler attributes through data-wp-bind, prototype pollution through data-wp-context JSON, directive names and namespaces, and post-content elements shadowing the Interactivity script-module data by ID. Anyone viewing the post, including administrators, could have attacker-controlled script run in their browser, or the page’s interactive blocks could stop working. Fixed in WordPress 7.1.4 and the matching 7.0.8 … 6.4.14 branch releases.
This vulnerability affects the following application versions:
- WordPress 6.4
- WordPress 6.4.1
- WordPress 6.4.2
- WordPress 6.4.3
- WordPress 6.4.4
- WordPress 6.4.5
- WordPress 6.4.6
- WordPress 6.4.7
- WordPress 6.4.8
- WordPress 6.4.9
- WordPress 6.4.10
- WordPress 6.4.11
- WordPress 6.4.12
- WordPress 6.4.13
- WordPress 6.5
- WordPress 6.5.2
- WordPress 6.5.3
- WordPress 6.5.4
- WordPress 6.5.5
- WordPress 6.5.6
- WordPress 6.5.7
- WordPress 6.5.8
- WordPress 6.5.9
- WordPress 6.5.10
- WordPress 6.5.11
- WordPress 6.5.12
- WordPress 6.5.13
- WordPress 6.6
- WordPress 6.6.1
- WordPress 6.6.2
- WordPress 6.6.3
- WordPress 6.6.4
- WordPress 6.6.5
- WordPress 6.6.6
- WordPress 6.6.7
- WordPress 6.6.8
- WordPress 6.6.9
- WordPress 6.6.10
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.7.5
- WordPress 6.7.6
- WordPress 6.7.7
- WordPress 6.7.8
- WordPress 6.7.9
- WordPress 6.7.10
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.8.4
- WordPress 6.8.5
- WordPress 6.8.6
- WordPress 6.8.7
- WordPress 6.8.8
- WordPress 6.8.9
- WordPress 6.8.10
- WordPress 6.8.11
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 6.9.6
- WordPress 6.9.7
- WordPress 6.9.8
- WordPress 6.9.9
- WordPress 6.9.10
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2
- WordPress 7.0.3
- WordPress 7.0.4
- WordPress 7.0.5
- WordPress 7.0.6
- WordPress 7.0.7
- WordPress 7.1
- WordPress 7.1.1
- WordPress 7.1.2
- WordPress 7.1.3