CVE-2022-33994

    Dashboard / Vulnerabilities / CVE-2022-33994

    CVE-2022-33994

    Published: 30 Jul 2022Last Modified: 11 Mar 2026

    Summary:

    Details: The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators.

    References: , https://blog.jitendrapatro.me/cve-2022-33994-stored-xss-in-wordpress/, https://patchstack.com/articles/patchstack-weekly-svg-xss-reported-in-gutenberg/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-33994 | CVE-DB