A user with the Contributor role or higher could save an element that passes KSES and give it an Interactivity API binding (data-wp-bind–data) that replaces the element’s data attribute at render time, pointing it at an arbitrary URL such as an admin page when an administrator views the post. Fixed in WordPress 7.1.4, which drops such bindings at save time and when the directives are processed.

This vulnerability affects the following application versions:

  • WordPress 6.6
  • WordPress 6.6.1
  • WordPress 6.6.2
  • WordPress 6.6.3
  • WordPress 6.6.4
  • WordPress 6.6.5
  • WordPress 6.6.6
  • WordPress 6.6.7
  • WordPress 6.6.8
  • WordPress 6.6.9
  • WordPress 6.6.10
  • WordPress 6.7
  • WordPress 6.7.1
  • WordPress 6.7.2
  • WordPress 6.7.3
  • WordPress 6.7.4
  • WordPress 6.7.5
  • WordPress 6.7.6
  • WordPress 6.7.7
  • WordPress 6.7.8
  • WordPress 6.7.9
  • WordPress 6.7.10
  • WordPress 6.8
  • WordPress 6.8.1
  • WordPress 6.8.2
  • WordPress 6.8.3
  • WordPress 6.8.4
  • WordPress 6.8.5
  • WordPress 6.8.6
  • WordPress 6.8.7
  • WordPress 6.8.8
  • WordPress 6.8.9
  • WordPress 6.8.10
  • WordPress 6.8.11
  • WordPress 6.9
  • WordPress 6.9.1
  • WordPress 6.9.2
  • WordPress 6.9.3
  • WordPress 6.9.4
  • WordPress 6.9.5
  • WordPress 6.9.6
  • WordPress 6.9.7
  • WordPress 6.9.8
  • WordPress 6.9.9
  • WordPress 6.9.10
  • WordPress 7.0
  • WordPress 7.0.1
  • WordPress 7.0.2
  • WordPress 7.0.3
  • WordPress 7.0.4
  • WordPress 7.0.5
  • WordPress 7.0.6
  • WordPress 7.0.7
  • WordPress 7.1
  • WordPress 7.1.1
  • WordPress 7.1.2
  • WordPress 7.1.3

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *

Om os

Standoutmedia er et webbureau dedikeret til WordPress platformen.
Vi driver egne hostingløsninger, hvor tusindvis af kunder hver dag modtager sikkerhedsopdateringer.

Læs mere om os her: https://standoutmedia.dk/