CVE-2022-33994

CVE-2022-33994 describes a stored Cross-Site Scripting (XSS) vulnerability in the WordPress Gutenberg plugin, versions up to 13.7.3. A low-privileged Contributor can inject an SVG document containing an XSS payload via the "Insert from URL" feature. While the XSS does not execute in the WordPress domain, this behavior differs from other products and could be a concern for some administrators. The vulnerability has a CVSS score of 3.0 (LOW), indicating a network attack vector with high attack complexity, requiring user interaction, and resulting in low integrity impact. Its EPSS score is very low, suggesting a minimal likelihood of exploitation. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also absent, indicating a lack of widespread attention or exploitation.