Description
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WordPress | wordpress-develop | >= 5.4.0, < 5.4.2, >= 5.3.0, < 5.3.4, >= 5.2.0, < 5.2.7, >= 5.1.0, < 5.1.6, >= 5.0.0, < 5.0.10, >= 4.9.0, < 4.9.15, >= 4.8.0, < 4.8.14, >= 4.7.0, < 4.7.18, >= 4.6.0, < 4.6.19, >= 4.5.0, < 4.5.22, >= 4.4.0, < 4.4.23, >= 4.3.0, < 4.3.24, >= 4.2.0, < 4.2.28, >= 4.1.0, < 4.1.31, >= 4.0.0, < 4.0.31, >= … | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 5.4.2+dfsg1-1 | — |
| Debian 13 | wordpress | 5.4.2+dfsg1-1 | — |
| Debian 12 | wordpress | 5.4.2+dfsg1-1 | — |
| Debian 10 | wordpress | 5.0.10+dfsg1-0+deb10u1 | DSA-4709-1 |
| Debian 9 | wordpress | 4.7.18+dfsg-1+deb9u1 | DLA-2371-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | wordpress | 4.1.31+dfsg-0+deb8u1 | DLA-2269-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | wordpress | No fix yet | — |
| Ubuntu 20.04 LTS | wordpress | No fix yet | — |
| Ubuntu 18.04 LTS | wordpress | No fix yet | — |
| Ubuntu 16.04 LTS | wordpress | No fix yet | — |
Advisories 3
- DSA-4709-1 wordpress - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2371-1 wordpress - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2269-1 wordpress - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-87h4-phjv-rm6p
- https://github.com/WordPress/wordpress-develop/commit/404f397b4012fd9d382e55bf7d206c1317f01148
- FEDORA-2020-8447a3e195 vendor-advisory
- FEDORA-2020-bbedd29391 vendor-advisory
- DSA-4709 vendor-advisory
- [debian-lts-announce] 20200701 [SECURITY] [DLA 2269-1] wordpress security update mailing-list
- [debian-lts-announce] 20200911 [SECURITY] [DLA 2371-1] wordpress security update mailing-list