Sam Thomas (jazzy2fives) has been credited with discovery of this particular XSS vulnerability.
Starting in versions 5.x, WordPress introduced a “block editor” which attempts to mimic modern editor, as offered by sites like Medium. The editor with its sleek design appears to be more lightweight than its predecessor Classic Editor that has shipped with WordPress versions.
Unlike WordPress vulns. we hear about these days which impact various plugins, this one is in the Core platform itself, prompting an urgent need for users to patch their installations!
The advisory additionally mentions other security updates along with crediting those who reported these vulnerabilities:
WordPress versions 5.4 and earlier are affected by the following bugs, which are fixed in version 5.4.2. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.
- Props to Ben Bidner of the WordPress Security Team for finding an open redirect issue in wp_validate_redirect().
- Props to Nrimo Ing Pandum for finding an authenticated XSS issue via theme uploads.
- Props to Simon Scannell of RIPS Technologies for finding an issue where set-screen-option can be misused by plugins leading to privilege escalation.
- Props to Carolina Nymark for discovering an issue where comments from password-protected posts and pages could be displayed under certain conditions.
Users are advised to update their WordPress installations. Should automatic updates be not enabled, WordPress 5.4.2 can be downloaded by navigating to your website’s Admin Dashboard and navigating to Updates → Update Now.
(C) 2020. Ax Sharma. Originally published on Security Report.