CVE-2023-38000

Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

• CWE-79

• https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cveExploit, Third Party Advisory
• https://patchstack.com/database/vulnerability/gutenberg/wordpress-gutenberg-plugin-16-8-0-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cveThird Party Advisory
• https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-3-2-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cveThird Party Advisory
• https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cveExploit, Third Party Advisory
• https://patchstack.com/database/vulnerability/gutenberg/wordpress-gutenberg-plugin-16-8-0-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cveThird Party Advisory
• https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-3-2-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cveThird Party Advisory

Published

Oct 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37995Cross-Site Request Forgery (CSRF) vulnerability in Chetan Go…8.8
• CVE-2023-37996Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix …8.8
• CVE-2023-37997Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-37998Cross-Site Request Forgery (CSRF) vulnerability in Saas Disa…8.8
• CVE-2023-37999Improper Privilege Management vulnerability in HasThemes HT …9.8
• CVE-2023-3800A vulnerability was found in EasyAdmin8 2.0.2.2. It has been…6.6
• CVE-2023-38001IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site re…6.5
• CVE-2023-38002IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an aut…8.8
• CVE-2023-38003IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Se…7.2
• CVE-2023-38005IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and…4.3
• CVE-2023-38007IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Powe…5.4
• CVE-2023-38009IBM Cognos Mobile Client 1.1 iOS may be vulnerable to inform…5.9