CVE-2022-21662: WordPress Core Stored XSS Vulnerability

CVE-2022-21662 Overview

CVE-2022-21662 is a stored Cross-Site Scripting (XSS) vulnerability in WordPress, the widely-used open-source content management system. This vulnerability allows low-privileged authenticated users, such as those with the Author role, to inject and execute malicious JavaScript code that persists within the WordPress environment. When high-privileged users (administrators, editors) view the affected content, the malicious script executes in their browser context, potentially leading to session hijacking, privilege escalation, or unauthorized administrative actions.

Critical Impact

Low-privileged users can execute stored XSS attacks targeting administrators, potentially leading to complete site compromise through session theft or unauthorized administrative actions.

Affected Products

• WordPress versions prior to 5.8.3
• Debian Linux 9.0, 10.0, and 11.0 (via packaged WordPress)
• All WordPress installations back to version 3.7 (security patches provided down to version 3.7.37)

Discovery Timeline

• 2022-01-06 - CVE-2022-21662 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21662

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) exists within WordPress core functionality and can be exploited by authenticated users with limited privileges such as the Author role. The vulnerability allows these users to inject persistent JavaScript payloads that execute when higher-privileged users interact with the compromised content.

The attack requires network access and user interaction—specifically, an administrator or editor must view content created or modified by the attacker. Upon viewing, the injected JavaScript executes within the victim's authenticated session, providing the attacker with the ability to perform actions with the victim's elevated privileges.

The scope of this vulnerability extends beyond the vulnerable component, as successful exploitation can impact the confidentiality and integrity of the broader WordPress installation, including potential access to sensitive administrative functions, user data, and site configurations.

Root Cause

The root cause of CVE-2022-21662 stems from insufficient input sanitization and output encoding within WordPress core. User-supplied content submitted by low-privileged users is not properly validated or escaped before being rendered in contexts where higher-privileged users may view it. This allows HTML and JavaScript injection that persists in the database and executes upon subsequent page loads.

Attack Vector

The attack vector for this vulnerability requires:

1. An authenticated session with at least Author-level privileges
2. The ability to create or modify content that will be viewed by administrators
3. Injection of malicious JavaScript through the vulnerable input mechanism
4. A high-privileged user viewing the affected content, triggering script execution

The attacker crafts content containing malicious JavaScript payloads. When an administrator accesses the WordPress dashboard or views the affected content, the script executes in their browser with their session cookies and permissions. This can enable session hijacking, creation of rogue administrator accounts, installation of malicious plugins, or modification of site content.

Detection Methods for CVE-2022-21662

Indicators of Compromise

• Unexpected JavaScript code or suspicious <script> tags in post content, comments, or user-generated fields
• Unusual administrator account creations or privilege changes without authorization
• Browser-based attacks detected in web application firewall (WAF) logs originating from stored content
• Session tokens or cookies being transmitted to external domains

Detection Strategies

• Deploy web application firewall rules to detect and block common XSS payloads in WordPress content submissions
• Implement Content Security Policy (CSP) headers to restrict script execution sources and detect policy violations
• Enable WordPress audit logging plugins to monitor content changes by low-privileged users
• Review database content for suspicious JavaScript patterns in wp_posts and related tables

Monitoring Recommendations

• Monitor WordPress admin activity logs for unauthorized administrative actions following content views
• Configure browser-based XSS auditing and CSP violation reporting
• Establish baseline behavior for Author-role users and alert on anomalous content patterns
• Regularly scan WordPress database content for embedded scripts or suspicious markup

How to Mitigate CVE-2022-21662

Immediate Actions Required

• Update WordPress to version 5.8.3 or later immediately
• For legacy installations, apply security patches available down to version 3.7.37
• Enable WordPress automatic updates to receive future security patches
• Review recent content created by Author-level users for suspicious JavaScript

Patch Information

WordPress has released version 5.8.3 which addresses this vulnerability. Security patches have been backported to all supported WordPress versions, extending back to version 3.7.37. Organizations running Debian Linux should apply the corresponding security updates as documented in DSA-5039 and the Debian LTS Announcement. Fedora users should apply updates via the official package repositories.

For complete details, see the WordPress 5.8.3 Security Release and the GitHub Security Advisory GHSA-699q-3hj9-889w.

Workarounds

• No official workarounds are available; patching is the only complete remediation
• Implement a Web Application Firewall (WAF) with XSS filtering as a temporary defense layer
• Restrict Author-level and above privileges to trusted users only until patching is complete
• Deploy Content Security Policy headers to mitigate JavaScript execution from untrusted sources

# Update WordPress via WP-CLI
wp core update

# Verify WordPress version after update
wp core version

# Enable automatic updates in wp-config.php
# Add the following line:
# define( 'WP_AUTO_UPDATE_CORE', true );