{"id":"CVE-2025-58674","state":"PUBLISHED","title":"WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.","publishedAt":"2025-09-23T18:47:02.628Z","updatedAt":"2026-04-28T16:13:46.266Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","source":"Patchstack"},"assigner":"Patchstack","products":["WordPress WordPress"],"affected":[{"vendor":"WordPress","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"6.8","status":"affected","lessThanOrEqual":"6.8.2","changes":[{"at":"6.8.3","status":"unaffected"}],"versionType":"custom"},{"version":"6.7","status":"affected","lessThanOrEqual":"6.7.3","changes":[{"at":"6.7.4","status":"unaffected"}],"versionType":"custom"},{"version":"6.6","status":"affected","lessThanOrEqual":"6.6.3","changes":[{"at":"6.6.4","status":"unaffected"}],"versionType":"custom"},{"version":"6.5","status":"affected","lessThanOrEqual":"6.5.6","changes":[{"at":"6.5.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.4","status":"affected","lessThanOrEqual":"6.4.6","changes":[{"at":"6.4.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.3","status":"affected","lessThanOrEqual":"6.3.6","changes":[{"at":"6.3.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.2","status":"affected","lessThanOrEqual":"6.2.7","changes":[{"at":"6.2.8","status":"unaffected"}],"versionType":"custom"},{"version":"6.1","status":"affected","lessThanOrEqual":"6.1.8","changes":[{"at":"6.1.9","status":"unaffected"}],"versionType":"custom"},{"version":"6.0","status":"affected","lessThanOrEqual":"6.0.10","changes":[{"at":"6.0.11","status":"unaffected"}],"versionType":"custom"},{"version":"5.9","status":"affected","lessThanOrEqual":"5.9.11","changes":[{"at":"5.9.12","status":"unaffected"}],"versionType":"custom"},{"version":"5.8","status":"affected","lessThanOrEqual":"5.8.11","changes":[{"at":"5.8.12","status":"unaffected"}],"versionType":"custom"},{"version":"5.7","status":"affected","lessThanOrEqual":"5.7.13","changes":[{"at":"5.7.14","status":"unaffected"}],"versionType":"custom"},{"version":"5.6","status":"affected","lessThanOrEqual":"5.6.15","changes":[{"at":"5.6.16","status":"unaffected"}],"versionType":"custom"},{"version":"5.5","status":"affected","lessThanOrEqual":"5.5.16","changes":[{"at":"5.5.17","status":"unaffected"}],"versionType":"custom"},{"version":"5.4","status":"affected","lessThanOrEqual":"5.4.17","changes":[{"at":"5.4.18","status":"unaffected"}],"versionType":"custom"},{"version":"5.3","status":"affected","lessThanOrEqual":"5.3.19","changes":[{"at":"5.3.20","status":"unaffected"}],"versionType":"custom"},{"version":"5.2","status":"affected","lessThanOrEqual":"5.2.22","changes":[{"at":"5.2.23","status":"unaffected"}],"versionType":"custom"},{"version":"5.1","status":"affected","lessThanOrEqual":"5.1.20","changes":[{"at":"5.1.21","status":"unaffected"}],"versionType":"custom"},{"version":"5.0","status":"affected","lessThanOrEqual":"5.0.23","changes":[{"at":"5.0.24","status":"unaffected"}],"versionType":"custom"},{"version":"4.9","status":"affected","lessThanOrEqual":"4.9.27","changes":[{"at":"4.9.28","status":"unaffected"}],"versionType":"custom"},{"version":"4.8","status":"affected","lessThanOrEqual":"4.8.26","changes":[{"at":"4.8.27","status":"unaffected"}],"versionType":"custom"},{"version":"4.7","status":"affected","lessThanOrEqual":"4.7.30","changes":[{"at":"4.7.31","status":"unaffected"}],"versionType":"custom"}],"repo":"https://github.com/WordPress/WordPress"}],"references":["https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve","https://wordpress.org/news/2025/09/wordpress-6-8-3-release/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/58xxx/CVE-2025-58674.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-58674","state":"PUBLISHED","datePublished":"2025-09-23T18:47:02.628Z","dateUpdated":"2026-04-28T16:13:46.266Z","assignerShortName":"Patchstack","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateReserved":"2025-09-03T09:03:46.831Z"},"containers":{"cna":{"title":"WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability","descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30."}],"affected":[{"vendor":"WordPress","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"6.8","status":"affected","lessThanOrEqual":"6.8.2","changes":[{"at":"6.8.3","status":"unaffected"}],"versionType":"custom"},{"version":"6.7","status":"affected","lessThanOrEqual":"6.7.3","changes":[{"at":"6.7.4","status":"unaffected"}],"versionType":"custom"},{"version":"6.6","status":"affected","lessThanOrEqual":"6.6.3","changes":[{"at":"6.6.4","status":"unaffected"}],"versionType":"custom"},{"version":"6.5","status":"affected","lessThanOrEqual":"6.5.6","changes":[{"at":"6.5.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.4","status":"affected","lessThanOrEqual":"6.4.6","changes":[{"at":"6.4.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.3","status":"affected","lessThanOrEqual":"6.3.6","changes":[{"at":"6.3.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.2","status":"affected","lessThanOrEqual":"6.2.7","changes":[{"at":"6.2.8","status":"unaffected"}],"versionType":"custom"},{"version":"6.1","status":"affected","lessThanOrEqual":"6.1.8","changes":[{"at":"6.1.9","status":"unaffected"}],"versionType":"custom"},{"version":"6.0","status":"affected","lessThanOrEqual":"6.0.10","changes":[{"at":"6.0.11","status":"unaffected"}],"versionType":"custom"},{"version":"5.9","status":"affected","lessThanOrEqual":"5.9.11","changes":[{"at":"5.9.12","status":"unaffected"}],"versionType":"custom"},{"version":"5.8","status":"affected","lessThanOrEqual":"5.8.11","changes":[{"at":"5.8.12","status":"unaffected"}],"versionType":"custom"},{"version":"5.7","status":"affected","lessThanOrEqual":"5.7.13","changes":[{"at":"5.7.14","status":"unaffected"}],"versionType":"custom"},{"version":"5.6","status":"affected","lessThanOrEqual":"5.6.15","changes":[{"at":"5.6.16","status":"unaffected"}],"versionType":"custom"},{"version":"5.5","status":"affected","lessThanOrEqual":"5.5.16","changes":[{"at":"5.5.17","status":"unaffected"}],"versionType":"custom"},{"version":"5.4","status":"affected","lessThanOrEqual":"5.4.17","changes":[{"at":"5.4.18","status":"unaffected"}],"versionType":"custom"},{"version":"5.3","status":"affected","lessThanOrEqual":"5.3.19","changes":[{"at":"5.3.20","status":"unaffected"}],"versionType":"custom"},{"version":"5.2","status":"affected","lessThanOrEqual":"5.2.22","changes":[{"at":"5.2.23","status":"unaffected"}],"versionType":"custom"},{"version":"5.1","status":"affected","lessThanOrEqual":"5.1.20","changes":[{"at":"5.1.21","status":"unaffected"}],"versionType":"custom"},{"version":"5.0","status":"affected","lessThanOrEqual":"5.0.23","changes":[{"at":"5.0.24","status":"unaffected"}],"versionType":"custom"},{"version":"4.9","status":"affected","lessThanOrEqual":"4.9.27","changes":[{"at":"4.9.28","status":"unaffected"}],"versionType":"custom"},{"version":"4.8","status":"affected","lessThanOrEqual":"4.8.26","changes":[{"at":"4.8.27","status":"unaffected"}],"versionType":"custom"},{"version":"4.7","status":"affected","lessThanOrEqual":"4.7.30","changes":[{"at":"4.7.31","status":"unaffected"}],"versionType":"custom"}],"repo":"https://github.com/WordPress/WordPress"}],"references":[{"url":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://wordpress.org/news/2025/09/wordpress-6-8-3-release/","tags":["release-notes"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Patchstack","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateUpdated":"2026-04-28T16:13:46.266Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"savphill (Patchstack Bug Bounty Program)"},{"lang":"en","type":"coordinator","value":"John Blackbourn (WordPress core security team lead)"}],"impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592 Stored XSS"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."}],"value":"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."}],"source":{"discovery":"EXTERNAL"},"tags":["x_open-source"],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-23T19:15:09.886956Z","id":"CVE-2025-58674","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-23T19:17:35.099Z"}}]}}}