CVE-2020-4047: 
NixOS vulnerability analysis and mitigation

CVE-2020-4047 affects WordPress versions 3.7 through 5.4.1, where authenticated users with upload permissions (like authors) can inject JavaScript into media file attachment pages. The vulnerability was discovered by Luigi (gubello.me) and was patched in WordPress version 5.4.2, along with backported fixes for all affected versions (WordPress News, GitHub Advisory).

The vulnerability allows authenticated users with upload permissions to inject JavaScript code into media file attachment pages in a specific way. When these compromised media files are viewed by users with higher privileges, the injected JavaScript executes in their security context (WPScan).

When exploited, this vulnerability can lead to script execution in the context of higher privileged users when they view the compromised media file attachment pages. This could potentially allow attackers to perform actions with elevated privileges (GitHub Advisory).

The vulnerability requires an authenticated user account with upload permissions (such as an author role) to exploit. The attacker must be able to upload media files to the WordPress installation (WPScan).

The vulnerability was fixed in WordPress 5.4.2, with security patches also backported to earlier versions (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). Users should upgrade to these patched versions to protect against this vulnerability (WordPress News).