Automattic WordPress core < 7.1.1, 7.0 < 7.0.5, 6.9 < 6.9.8, 6.8 < 6.8.9, 6.7 < 6.7.8, 6.6 < 6.6.8, 6.5 < 6.5.11, 6.4 < 6.4.11, 6.3 < 6.3.11, 6.2 < 6.2.12, 6.1 < 6.1.13, 6.0 < 6.0.15, 5.9 < 5.9.17, 5.8 < 5.8.16, 5.7 < 5.7.18, 5.6 < 5.6.20, 5.5 < 5.5.21, 5.4 < 5.4.22, 5.3 < 5.3.24, 5.2 < 5.2.27, 5.1 < 5.1.25, 5.0 < 5.0.28, 4.9 < 4.9.32, 4.8 < 4.8.31, and 4.7 < 4.7.36 contain a DOM-based stored cross-site scripting caused by improper input neutralization during web page generation, letting unauthenticated attackers execute scripts via comment moderation bypass, exploit requires comment moderation disabled and bypass of comment approval.
Update to WordPress version 7.1.1 or later.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
A CVE describes the software, not your exposure. Panop discovers whether you run the affected product, then tests whether an attacker can actually reach it.
