CVE-2022-33994: The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG documen

Q: How do I fix CVE-2022-33994?

gutenberg: upgrade to newer than 13.7.3. Exact commands for each OS are on this page.

Q: Is CVE-2022-33994 being exploited?

CVE-2022-33994 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2022-33994 affect?

CVE-2022-33994 affects gutenberg. Severity is low (CVSS 3.0). The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; howe

Q: How urgent is CVE-2022-33994?

Priority 29/100. Public exploit reference

Routine

LOW 3.0UPGRADE

CVE-2022-33994 is a low-severity flaw (CVSS 3.0) affecting gutenberg. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrator

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	3.0 (Low)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.7% (top 46%)
CISA exploited list	No
Weakness	CWE-79
Published	2022-07-30
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: gutenberg project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-07-30 20:15 UTCPublished CVE record published
2026-06-17 04:49 UTCUpdated Record last modified

gutenberg project gutenberg UPGRADE

Affected: <= 13.7.3

Fixed in: newer than 13.7.3

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy gutenberg || rpm -q gutenberg || gutenberg --version

2. UPGRADE to newer than 13.7.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade gutenberg

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade gutenberg

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-33994?

gutenberg: upgrade to newer than 13.7.3. Exact commands for each OS are on this page.

Is CVE-2022-33994 being exploited?

CVE-2022-33994 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-33994 affect?

CVE-2022-33994 affects gutenberg. Severity is low (CVSS 3.0). The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; howe

How urgent is CVE-2022-33994?

Priority 29/100. Public exploit reference

Software pages

WordPress vulnerabilities

Related CVEs

CVE-2024-13284 HIGH 8.8 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This iss
CVE-2023-38000 MEDIUM 6.5 UPGRADE UPGRADE Auth

References

← Back to latest CVEs