2.4
Low
CVE-2020-4049 In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that…
Description
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress-develop 5.4 | 5.4.0 → < 5.4.2 | 5.4.2 |
| wordpress-develop 5.3 | 5.3.0 → < 5.3.4 | 5.3.4 |
| wordpress-develop 5.2 | 5.2.0 → < 5.2.7 | 5.2.7 |
| wordpress-develop 5.1 | 5.1.0 → < 5.1.6 | 5.1.6 |
| wordpress-develop 5.0 | 5.0.0 → < 5.0.10 | 5.0.10 |
| wordpress-develop 4.9 | 4.9.0 → < 4.9.15 | 4.9.15 |
| wordpress-develop 4.8 | 4.8.0 → < 4.8.14 | 4.8.14 |
| wordpress-develop 4.7 | 4.7.0 → < 4.7.18 | 4.7.18 |
| wordpress-develop 4.6 | 4.6.0 → < 4.6.19 | 4.6.19 |
Show the 9 other branches Hide the 9 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress-develop 4.5 | 4.5.0 → < 4.5.22 | 4.5.22 |
| wordpress-develop 4.4 | 4.4.0 → < 4.4.23 | 4.4.23 |
| wordpress-develop 4.3 | 4.3.0 → < 4.3.24 | 4.3.24 |
| wordpress-develop 4.2 | 4.2.0 → < 4.2.28 | 4.2.28 |
| wordpress-develop 4.1 | 4.1.0 → < 4.1.31 | 4.1.31 |
| wordpress-develop 4.0 | 4.0.0 → < 4.0.31 | 4.0.31 |
| wordpress-develop 3.9 | 3.9.0 → < 3.9.32 | 3.9.32 |
| wordpress-develop 3.8 | 3.8.0 → < 3.8.34 | 3.8.34 |
| wordpress-develop 3.7 | 3.7.0 → < 3.7.34 | 3.7.34 |
References
- wordpress.org wordpress.org
- github.com github.com
- github.com github.com
- FEDORA-2020-8447a3e195 lists.fedoraproject.org
- FEDORA-2020-bbedd29391 lists.fedoraproject.org
- DSA-4709 www.debian.org
- [debian-lts-announce] 20200701 [SECURITY] [DLA 2269-1] wordpress security update lists.debian.org
- [debian-lts-announce] 20200911 [SECURITY] [DLA 2371-1] wordpress security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of wordpress-develop
The 17 CVEs of wordpress-develop →
CVE-2024-31211
WordPress is an open publishing platform for the Web
5.5
Medium
CVE-2024-31210
WordPress is an open publishing platform for the Web
7.7
High
CVE-2022-21662
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database
8.0
High
CVE-2022-21663
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database
6.6
Medium