CVE-2020-4047

In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

We have discovered 219,874 live websites that are affected by CVE-2020-4047.

Run a Free Instant Scan

Affected Software

Product	WordPress
Category	Content Management System
Vulnerable Domains	219,874 live websites (2.53% of WordPress install base)
Vulnerable Versions	from 3.7 through 3.7.34 from 3.8 through 3.8.34 from 3.9 through 3.9.32 from 4 through 4.0.31 from 4.1 through 4.1.31 from 4.2 through 4.2.28 from 4.3 through 4.3.24 from 4.4 through 4.4.23 from 4.5 through 4.5.22 from 4.6 through 4.6.19 from 4.7 through 4.7.18 from 4.8 through 4.8.14 from 4.9 through 4.9.15 from 5 through 5.0.10 from 5.1 through 5.1.6 from 5.2 through 5.2.7 from 5.3 through 5.3.4 from 5.4 through 5.4.2
Vulnerable Versions Count	254 versions ( 38% of all versions)