CVE-2021-39201

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)

• CWE-79

• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-wh69-25hr-h94vThird Party Advisory
• https://hackerone.com/reports/1142140Permissions Required
• https://www.debian.org/security/2021/dsa-4985Third Party Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-wh69-25hr-h94vThird Party Advisory
• https://hackerone.com/reports/1142140Permissions Required
• https://www.debian.org/security/2021/dsa-4985Third Party Advisory

Published

Sep 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39196pcapture is an open source dumpcap web service interface . I…6.5
• CVE-2021-39197better_errors is an open source replacement for the standard…8.8
• CVE-2021-39198OroCRM is an open source Client Relationship Management (CRM…5.4
• CVE-2021-39199remark-html is an open source nodejs library which compiles …6.1
• CVE-2021-3920grav-plugin-admin is vulnerable to Improper Neutralization o…5.4
• CVE-2021-39200WordPress is a free and open-source content management syste…5.3
• CVE-2021-39202WordPress is a free and open-source content management syste…5.4
• CVE-2021-39203WordPress is a free and open-source content management syste…6.5
• CVE-2021-39204Pomerium is an open source identity-aware access proxy. Envo…7.5
• CVE-2021-39205Jitsi Meet is an open source video conferencing application.…6.1
• CVE-2021-39206Pomerium is an open source identity-aware access proxy. Envo…8.6
• CVE-2021-39207parlai is a framework for training and evaluating AI models …8.8