Intrusion Prevention

WordPress.Shortcode.Preview.XSS

Description

This indicates an attack attempt against a Cross-Site Scripting (XSS) vulnerability in WordPress CMS.
The vulnerability is caused by inadequate input filtering of html encoded character which leads to XSS vulnerabilities in shortcode function. A remote attacker may be able to exploit this to execute arbitrary script code within the context of the application.

Affected Products

WordPress 5.0 through 5.2.2

Impact

System Compromise : Remote attackers can execute arbitrary script code within the context of the target user's browser

Recommended Actions

Upgrade to the latest version, available from the website.
https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/

CVE References

CVE-2019-16219