Search
Find a vulnerability
Search criteria
6 vulnerabilities found for WordPress by Automattic
CVE-2026-93485 (GCVE-0-2026-93485)
Vulnerability from nvd – Published: 2026-09-18 06:00 – Updated: 2026-09-19 14:21 X_Open Source
VLAI
EPSS
VEX
Title
WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS.
This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.
The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:21 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/wordpre… | vdb-entry |
| https://wordpress.org/news/2026/09/wordpress-7-1-… | release-notes |
Impacted products
25 products
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
7.1 , < 7.1.1
(custom)
|
|
| Automattic | WordPress |
Affected:
7.0 , ≤ 7.0.4
(custom)
|
|
| Automattic | WordPress |
Affected:
6.9 , ≤ 6.9.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.8 , ≤ 6.8.8
(custom)
|
|
| Automattic | WordPress |
Affected:
6.7 , ≤ 6.7.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.6 , ≤ 6.6.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.5 , ≤ 6.5.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.4 , ≤ 6.4.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.3 , ≤ 6.3.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.2 , ≤ 6.2.11
(custom)
|
|
| Automattic | WordPress |
Affected:
6.1 , ≤ 6.1.12
(custom)
|
|
| Automattic | WordPress |
Affected:
6.0 , ≤ 6.0.14
(custom)
|
|
| Automattic | WordPress |
Affected:
5.9 , ≤ 5.9.16
(custom)
|
|
| Automattic | WordPress |
Affected:
5.8 , ≤ 5.8.15
(custom)
|
|
| Automattic | WordPress |
Affected:
5.7 , ≤ 5.7.17
(custom)
|
|
| Automattic | WordPress |
Affected:
5.6 , ≤ 5.6.19
(custom)
|
|
| Automattic | WordPress |
Affected:
5.5 , ≤ 5.5.20
(custom)
|
|
| Automattic | WordPress |
Affected:
5.4 , ≤ 5.4.21
(custom)
|
|
| Automattic | WordPress |
Affected:
5.3 , ≤ 5.3.23
(custom)
|
|
| Automattic | WordPress |
Affected:
5.2 , ≤ 5.2.26
(custom)
|
|
| Automattic | WordPress |
Affected:
5.1 , ≤ 5.1.24
(custom)
|
|
| Automattic | WordPress |
Affected:
5.0 , ≤ 5.0.27
(custom)
|
|
| Automattic | WordPress |
Affected:
4.9 , ≤ 4.9.31
(custom)
|
|
| Automattic | WordPress |
Affected:
4.8 , ≤ 4.8.30
(custom)
|
|
| Automattic | WordPress |
Affected:
4.7 , ≤ 4.7.35
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93485",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:21:30.559066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:21:52.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.1.1",
"status": "unaffected"
}
],
"lessThan": "7.1.1",
"status": "affected",
"version": "7.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.0.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.9.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.9.7",
"status": "affected",
"version": "6.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.8.9",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.8.8",
"status": "affected",
"version": "6.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.7.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.7.7",
"status": "affected",
"version": "6.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.6.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.6.7",
"status": "affected",
"version": "6.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.5.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.5.10",
"status": "affected",
"version": "6.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.4.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.4.10",
"status": "affected",
"version": "6.4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.3.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.3.10",
"status": "affected",
"version": "6.3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.2.12",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.2.11",
"status": "affected",
"version": "6.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.1.13",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.1.12",
"status": "affected",
"version": "6.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.0.14",
"status": "affected",
"version": "6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.9.17",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.9.16",
"status": "affected",
"version": "5.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.8.16",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.8.15",
"status": "affected",
"version": "5.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.7.18",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.7.17",
"status": "affected",
"version": "5.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.6.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.6.19",
"status": "affected",
"version": "5.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.5.21",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.5.20",
"status": "affected",
"version": "5.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.4.22",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.4.21",
"status": "affected",
"version": "5.4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.3.24",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.3.23",
"status": "affected",
"version": "5.3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.2.27",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.2.26",
"status": "affected",
"version": "5.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.1.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.1.24",
"status": "affected",
"version": "5.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.0.28",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.27",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.9.32",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.9.31",
"status": "affected",
"version": "4.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.8.31",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.8.30",
"status": "affected",
"version": "4.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.7.36",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.7.35",
"status": "affected",
"version": "4.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Automattic WordPress core allows DOM-Based XSS.\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eThis issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003cp\u003e\u003cspan\u003eThe Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Automattic WordPress core allows DOM-Based XSS.\n\n\nThis issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.\n\n\n\n\nThe Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T06:00:05.645Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress to the latest available version of it\u0027s version range:\u0026nbsp;\u003cspan\u003e7.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, 5.2.27, 5.1.25, 5.0.28, 4.9.32, 4.8.31, 4.7.36\u003c/span\u003e"
}
],
"value": "Update the WordPress to the latest available version of it\u0027s version range:\u00a07.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, 5.2.27, 5.1.25, 5.0.28, 4.9.32, 4.8.31, 4.7.36"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress core \u003c= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-93485",
"datePublished": "2026-09-18T06:00:05.645Z",
"dateReserved": "2026-09-18T05:11:39.339Z",
"dateUpdated": "2026-09-19T14:21:52.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-32111 (GCVE-0-2024-32111)
Vulnerability from nvd – Published: 2024-06-25 13:35 – Updated: 2026-04-28 16:09
VLAI
EPSS
VEX
Title
WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-27 13:40 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/vulnerability/wor… | vdb-entry |
| https://wordpress.org/news/2024/06/wordpress-6-5-5/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
6.5 , ≤ 6.5.4
(custom)
Affected: 6.4 , ≤ 6.4.4 (custom) Affected: 6.3 , ≤ 6.3.4 (custom) Affected: 6.2 , ≤ 6.2.5 (custom) Affected: 6.1 , ≤ 6.1.6 (custom) Affected: 6.0 , ≤ 6.0.8 (custom) Affected: 5.9 , ≤ 5.9.9 (custom) Affected: 5.8 , ≤ 5.8.9 (custom) Affected: 5.7 , ≤ 5.7.11 (custom) Affected: 5.6 , ≤ 5.6.13 (custom) Affected: 5.5 , ≤ 5.5.14 (custom) Affected: 5.4 , ≤ 5.4.15 (custom) Affected: 5.3 , ≤ 5.3.17 (custom) Affected: 5.2 , ≤ 5.2.20 (custom) Affected: 5.1 , ≤ 5.1.18 (custom) Affected: 5.0 , ≤ 5.0.21 (custom) Affected: 4.9 , ≤ 4.9.25 (custom) Affected: 4.8 , ≤ 4.8.24 (custom) Affected: 4.7 , ≤ 4.7.28 (custom) Affected: 4.6 , ≤ 4.6.28 (custom) Affected: 4.5 , ≤ 4.5.31 (custom) Affected: 4.4 , ≤ 4.4.32 (custom) Affected: 4.3 , ≤ 4.3.33 (custom) Affected: 4.2 , ≤ 4.2.37 (custom) Affected: 4.1 , ≤ 4.1.40 (custom) |
Date Public
2024-06-25 13:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-27T13:40:36.313046Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T19:20:35.758Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:06:44.011Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.5.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.5.4",
"status": "affected",
"version": "6.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.4.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.4.4",
"status": "affected",
"version": "6.4",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.3.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.3.4",
"status": "affected",
"version": "6.3",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.6",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.2.5",
"status": "affected",
"version": "6.2",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.1.7",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.1.6",
"status": "affected",
"version": "6.1",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.9",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.0.8",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.9.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.9.9",
"status": "affected",
"version": "5.9",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.8.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.8.9",
"status": "affected",
"version": "5.8",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.7.12",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.7.11",
"status": "affected",
"version": "5.7",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.6.14",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.6.13",
"status": "affected",
"version": "5.6",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.5.15",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.5.14",
"status": "affected",
"version": "5.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.4.16",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.4.15",
"status": "affected",
"version": "5.4",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.3.18",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.3.17",
"status": "affected",
"version": "5.3",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.2.21",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.2.20",
"status": "affected",
"version": "5.2",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.1.19",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.1.18",
"status": "affected",
"version": "5.1",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.0.22",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.21",
"status": "affected",
"version": "5.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.9.26",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.9.25",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.8.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.8.24",
"status": "affected",
"version": "4.8",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.7.29",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.7.28",
"status": "affected",
"version": "4.7",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.6.29",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.6.28",
"status": "affected",
"version": "4.6",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.5.32",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.5.31",
"status": "affected",
"version": "4.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.4.33",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.4.32",
"status": "affected",
"version": "4.4",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.3.34",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.3.33",
"status": "affected",
"version": "4.3",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.2.38",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.2.37",
"status": "affected",
"version": "4.2",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.1.41",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.40",
"status": "affected",
"version": "4.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad (Patchstack)"
},
{
"lang": "en",
"type": "finder",
"value": "Edouard L. (Patchstack)"
},
{
"lang": "en",
"type": "finder",
"value": "David Fifield"
},
{
"lang": "en",
"type": "finder",
"value": "x89"
},
{
"lang": "en",
"type": "finder",
"value": "apple502j"
},
{
"lang": "en",
"type": "finder",
"value": "mishre"
}
],
"datePublic": "2024-06-25T13:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Automattic WordPress allows Relative Path Traversal.\u003cp\u003eThis issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40."
}
],
"impacts": [
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139 Relative Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:09:34.172Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to safe (6.5.5,\u00a06.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10, 5.8.10, 5.7.12, 5.6.14, 5.5.15, 5.4.16, 5.3.18, 5.2.21, 5.1.19, 5.0.22, 4.9.26, 4.8.25, 4.7.29, 4.6.29, 4.5.32, 4.4.33, 4.3.34, 4.2.38, 4.1.41) or higher version."
}
],
"value": "Update to safe (6.5.5,\u00a06.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10, 5.8.10, 5.7.12, 5.6.14, 5.5.15, 5.4.16, 5.3.18, 5.2.21, 5.1.19, 5.0.22, 4.9.26, 4.8.25, 4.7.29, 4.6.29, 4.5.32, 4.4.33, 4.3.34, 4.2.38, 4.1.41) or higher version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress core \u003c 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2024-32111",
"datePublished": "2024-06-25T13:35:45.596Z",
"dateReserved": "2024-04-10T19:19:25.420Z",
"dateUpdated": "2026-04-28T16:09:34.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-31111 (GCVE-0-2024-31111)
Vulnerability from nvd – Published: 2024-06-25 12:54 – Updated: 2026-04-28 16:09
VLAI
EPSS
VEX
Title
WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-25 13:49 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/vulnerability/wor… | vdb-entry |
| https://wordpress.org/news/2024/06/wordpress-6-5-5/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
6.5 , ≤ 6.5.4
(custom)
Affected: 6.4 , ≤ 6.4.4 (custom) Affected: 6.3 , ≤ 6.3.4 (custom) Affected: 6.2 , ≤ 6.2.5 (custom) Affected: 6.1 , ≤ 6.1.6 (custom) Affected: 6.0 , ≤ 6.0.8 (custom) Affected: 5.9 , ≤ 5.9.9 (custom) |
Date Public
2024-06-25 12:54
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-25T13:49:17.784337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-25T13:49:38.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:46:04.672Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-5-5-cross-site-scripting-xss-via-template-part-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.5.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.5.4",
"status": "affected",
"version": "6.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.4.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.4.4",
"status": "affected",
"version": "6.4",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.3.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.3.4",
"status": "affected",
"version": "6.3",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.6",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.2.5",
"status": "affected",
"version": "6.2",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.1.7",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.1.6",
"status": "affected",
"version": "6.1",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.9",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.0.8",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.9.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.9.9",
"status": "affected",
"version": "5.9",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad (Patchstack)"
}
],
"datePublic": "2024-06-25T12:54:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Automattic WordPress allows Stored XSS.\u003cp\u003eThis issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:09:28.063Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-5-5-cross-site-scripting-xss-via-template-part-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to safe (6.5.5, 6.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10) or higher version."
}
],
"value": "Update to safe (6.5.5, 6.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10) or higher version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Core \u003c 6.5.5 - Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2024-31111",
"datePublished": "2024-06-25T12:54:47.977Z",
"dateReserved": "2024-03-28T06:58:01.377Z",
"dateUpdated": "2026-04-28T16:09:28.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93485 (GCVE-0-2026-93485)
Vulnerability from cvelistv5 – Published: 2026-09-18 06:00 – Updated: 2026-09-19 14:21 X_Open Source
VLAI
EPSS
VEX
Title
WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS.
This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.
The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:21 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/wordpre… | vdb-entry |
| https://wordpress.org/news/2026/09/wordpress-7-1-… | release-notes |
Impacted products
25 products
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
7.1 , < 7.1.1
(custom)
|
|
| Automattic | WordPress |
Affected:
7.0 , ≤ 7.0.4
(custom)
|
|
| Automattic | WordPress |
Affected:
6.9 , ≤ 6.9.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.8 , ≤ 6.8.8
(custom)
|
|
| Automattic | WordPress |
Affected:
6.7 , ≤ 6.7.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.6 , ≤ 6.6.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.5 , ≤ 6.5.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.4 , ≤ 6.4.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.3 , ≤ 6.3.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.2 , ≤ 6.2.11
(custom)
|
|
| Automattic | WordPress |
Affected:
6.1 , ≤ 6.1.12
(custom)
|
|
| Automattic | WordPress |
Affected:
6.0 , ≤ 6.0.14
(custom)
|
|
| Automattic | WordPress |
Affected:
5.9 , ≤ 5.9.16
(custom)
|
|
| Automattic | WordPress |
Affected:
5.8 , ≤ 5.8.15
(custom)
|
|
| Automattic | WordPress |
Affected:
5.7 , ≤ 5.7.17
(custom)
|
|
| Automattic | WordPress |
Affected:
5.6 , ≤ 5.6.19
(custom)
|
|
| Automattic | WordPress |
Affected:
5.5 , ≤ 5.5.20
(custom)
|
|
| Automattic | WordPress |
Affected:
5.4 , ≤ 5.4.21
(custom)
|
|
| Automattic | WordPress |
Affected:
5.3 , ≤ 5.3.23
(custom)
|
|
| Automattic | WordPress |
Affected:
5.2 , ≤ 5.2.26
(custom)
|
|
| Automattic | WordPress |
Affected:
5.1 , ≤ 5.1.24
(custom)
|
|
| Automattic | WordPress |
Affected:
5.0 , ≤ 5.0.27
(custom)
|
|
| Automattic | WordPress |
Affected:
4.9 , ≤ 4.9.31
(custom)
|
|
| Automattic | WordPress |
Affected:
4.8 , ≤ 4.8.30
(custom)
|
|
| Automattic | WordPress |
Affected:
4.7 , ≤ 4.7.35
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93485",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:21:30.559066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:21:52.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.1.1",
"status": "unaffected"
}
],
"lessThan": "7.1.1",
"status": "affected",
"version": "7.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.0.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.9.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.9.7",
"status": "affected",
"version": "6.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.8.9",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.8.8",
"status": "affected",
"version": "6.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.7.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.7.7",
"status": "affected",
"version": "6.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.6.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.6.7",
"status": "affected",
"version": "6.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.5.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.5.10",
"status": "affected",
"version": "6.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.4.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.4.10",
"status": "affected",
"version": "6.4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.3.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.3.10",
"status": "affected",
"version": "6.3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.2.12",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.2.11",
"status": "affected",
"version": "6.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.1.13",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.1.12",
"status": "affected",
"version": "6.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.0.14",
"status": "affected",
"version": "6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.9.17",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.9.16",
"status": "affected",
"version": "5.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.8.16",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.8.15",
"status": "affected",
"version": "5.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.7.18",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.7.17",
"status": "affected",
"version": "5.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.6.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.6.19",
"status": "affected",
"version": "5.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.5.21",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.5.20",
"status": "affected",
"version": "5.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.4.22",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.4.21",
"status": "affected",
"version": "5.4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.3.24",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.3.23",
"status": "affected",
"version": "5.3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.2.27",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.2.26",
"status": "affected",
"version": "5.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.1.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.1.24",
"status": "affected",
"version": "5.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.0.28",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.27",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.9.32",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.9.31",
"status": "affected",
"version": "4.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.8.31",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.8.30",
"status": "affected",
"version": "4.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.7.36",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.7.35",
"status": "affected",
"version": "4.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Automattic WordPress core allows DOM-Based XSS.\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eThis issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003cp\u003e\u003cspan\u003eThe Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Automattic WordPress core allows DOM-Based XSS.\n\n\nThis issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.\n\n\n\n\nThe Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T06:00:05.645Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress to the latest available version of it\u0027s version range:\u0026nbsp;\u003cspan\u003e7.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, 5.2.27, 5.1.25, 5.0.28, 4.9.32, 4.8.31, 4.7.36\u003c/span\u003e"
}
],
"value": "Update the WordPress to the latest available version of it\u0027s version range:\u00a07.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, 5.2.27, 5.1.25, 5.0.28, 4.9.32, 4.8.31, 4.7.36"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress core \u003c= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-93485",
"datePublished": "2026-09-18T06:00:05.645Z",
"dateReserved": "2026-09-18T05:11:39.339Z",
"dateUpdated": "2026-09-19T14:21:52.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-32111 (GCVE-0-2024-32111)
Vulnerability from cvelistv5 – Published: 2024-06-25 13:35 – Updated: 2026-04-28 16:09
VLAI
EPSS
VEX
Title
WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-27 13:40 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/vulnerability/wor… | vdb-entry |
| https://wordpress.org/news/2024/06/wordpress-6-5-5/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
6.5 , ≤ 6.5.4
(custom)
Affected: 6.4 , ≤ 6.4.4 (custom) Affected: 6.3 , ≤ 6.3.4 (custom) Affected: 6.2 , ≤ 6.2.5 (custom) Affected: 6.1 , ≤ 6.1.6 (custom) Affected: 6.0 , ≤ 6.0.8 (custom) Affected: 5.9 , ≤ 5.9.9 (custom) Affected: 5.8 , ≤ 5.8.9 (custom) Affected: 5.7 , ≤ 5.7.11 (custom) Affected: 5.6 , ≤ 5.6.13 (custom) Affected: 5.5 , ≤ 5.5.14 (custom) Affected: 5.4 , ≤ 5.4.15 (custom) Affected: 5.3 , ≤ 5.3.17 (custom) Affected: 5.2 , ≤ 5.2.20 (custom) Affected: 5.1 , ≤ 5.1.18 (custom) Affected: 5.0 , ≤ 5.0.21 (custom) Affected: 4.9 , ≤ 4.9.25 (custom) Affected: 4.8 , ≤ 4.8.24 (custom) Affected: 4.7 , ≤ 4.7.28 (custom) Affected: 4.6 , ≤ 4.6.28 (custom) Affected: 4.5 , ≤ 4.5.31 (custom) Affected: 4.4 , ≤ 4.4.32 (custom) Affected: 4.3 , ≤ 4.3.33 (custom) Affected: 4.2 , ≤ 4.2.37 (custom) Affected: 4.1 , ≤ 4.1.40 (custom) |
Date Public
2024-06-25 13:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-27T13:40:36.313046Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T19:20:35.758Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:06:44.011Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.5.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.5.4",
"status": "affected",
"version": "6.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.4.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.4.4",
"status": "affected",
"version": "6.4",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.3.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.3.4",
"status": "affected",
"version": "6.3",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.6",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.2.5",
"status": "affected",
"version": "6.2",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.1.7",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.1.6",
"status": "affected",
"version": "6.1",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.9",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.0.8",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.9.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.9.9",
"status": "affected",
"version": "5.9",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.8.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.8.9",
"status": "affected",
"version": "5.8",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.7.12",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.7.11",
"status": "affected",
"version": "5.7",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.6.14",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.6.13",
"status": "affected",
"version": "5.6",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.5.15",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.5.14",
"status": "affected",
"version": "5.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.4.16",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.4.15",
"status": "affected",
"version": "5.4",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.3.18",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.3.17",
"status": "affected",
"version": "5.3",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.2.21",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.2.20",
"status": "affected",
"version": "5.2",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.1.19",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.1.18",
"status": "affected",
"version": "5.1",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.0.22",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.21",
"status": "affected",
"version": "5.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.9.26",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.9.25",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.8.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.8.24",
"status": "affected",
"version": "4.8",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.7.29",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.7.28",
"status": "affected",
"version": "4.7",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.6.29",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.6.28",
"status": "affected",
"version": "4.6",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.5.32",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.5.31",
"status": "affected",
"version": "4.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.4.33",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.4.32",
"status": "affected",
"version": "4.4",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.3.34",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.3.33",
"status": "affected",
"version": "4.3",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.2.38",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.2.37",
"status": "affected",
"version": "4.2",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.1.41",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.40",
"status": "affected",
"version": "4.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad (Patchstack)"
},
{
"lang": "en",
"type": "finder",
"value": "Edouard L. (Patchstack)"
},
{
"lang": "en",
"type": "finder",
"value": "David Fifield"
},
{
"lang": "en",
"type": "finder",
"value": "x89"
},
{
"lang": "en",
"type": "finder",
"value": "apple502j"
},
{
"lang": "en",
"type": "finder",
"value": "mishre"
}
],
"datePublic": "2024-06-25T13:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Automattic WordPress allows Relative Path Traversal.\u003cp\u003eThis issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40."
}
],
"impacts": [
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139 Relative Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:09:34.172Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to safe (6.5.5,\u00a06.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10, 5.8.10, 5.7.12, 5.6.14, 5.5.15, 5.4.16, 5.3.18, 5.2.21, 5.1.19, 5.0.22, 4.9.26, 4.8.25, 4.7.29, 4.6.29, 4.5.32, 4.4.33, 4.3.34, 4.2.38, 4.1.41) or higher version."
}
],
"value": "Update to safe (6.5.5,\u00a06.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10, 5.8.10, 5.7.12, 5.6.14, 5.5.15, 5.4.16, 5.3.18, 5.2.21, 5.1.19, 5.0.22, 4.9.26, 4.8.25, 4.7.29, 4.6.29, 4.5.32, 4.4.33, 4.3.34, 4.2.38, 4.1.41) or higher version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress core \u003c 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2024-32111",
"datePublished": "2024-06-25T13:35:45.596Z",
"dateReserved": "2024-04-10T19:19:25.420Z",
"dateUpdated": "2026-04-28T16:09:34.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-31111 (GCVE-0-2024-31111)
Vulnerability from cvelistv5 – Published: 2024-06-25 12:54 – Updated: 2026-04-28 16:09
VLAI
EPSS
VEX
Title
WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-25 13:49 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/vulnerability/wor… | vdb-entry |
| https://wordpress.org/news/2024/06/wordpress-6-5-5/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
6.5 , ≤ 6.5.4
(custom)
Affected: 6.4 , ≤ 6.4.4 (custom) Affected: 6.3 , ≤ 6.3.4 (custom) Affected: 6.2 , ≤ 6.2.5 (custom) Affected: 6.1 , ≤ 6.1.6 (custom) Affected: 6.0 , ≤ 6.0.8 (custom) Affected: 5.9 , ≤ 5.9.9 (custom) |
Date Public
2024-06-25 12:54
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-25T13:49:17.784337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-25T13:49:38.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:46:04.672Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-5-5-cross-site-scripting-xss-via-template-part-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.5.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.5.4",
"status": "affected",
"version": "6.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.4.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.4.4",
"status": "affected",
"version": "6.4",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.3.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.3.4",
"status": "affected",
"version": "6.3",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.6",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.2.5",
"status": "affected",
"version": "6.2",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.1.7",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.1.6",
"status": "affected",
"version": "6.1",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.9",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.0.8",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "5.9.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.9.9",
"status": "affected",
"version": "5.9",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad (Patchstack)"
}
],
"datePublic": "2024-06-25T12:54:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Automattic WordPress allows Stored XSS.\u003cp\u003eThis issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:09:28.063Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-5-5-cross-site-scripting-xss-via-template-part-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to safe (6.5.5, 6.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10) or higher version."
}
],
"value": "Update to safe (6.5.5, 6.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10) or higher version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Core \u003c 6.5.5 - Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2024-31111",
"datePublished": "2024-06-25T12:54:47.977Z",
"dateReserved": "2024-03-28T06:58:01.377Z",
"dateUpdated": "2026-04-28T16:09:28.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}