CVE-2025-58674
Full vulnerability record from the local CVENow database.
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.
Severity
MEDIUM
CVSS score
5.9
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-09-23 19:15:41.603000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-58674",
"sourceIdentifier": "[email protected]",
"published": "2025-09-23T19:15:41.603",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30."
},
{
"lang": "es",
"value": "Neutralización Incorrecta de Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en WordPress permite XSS Almacenado. El equipo de seguridad del núcleo de WordPress está al tanto del problema y trabajando en una solución. Esta es una vulnerabilidad de baja severidad que requiere que un atacante tenga privilegios de usuario de Autor o superiores para ejecutar el vector de ataque. Este problema afecta a WordPress: desde 6.8 hasta 6.8.2, desde 6.7 hasta 6.7.3, desde 6.6 hasta 6.6.3, desde 6.5 hasta 6.5.6, desde 6.4 hasta 6.4.6, desde 6.3 hasta 6.3.6, desde 6.2 hasta 6.2.7, desde 6.1 hasta 6.1.8, desde 6.0 hasta 6.0.10, desde 5.9 hasta 5.9.11, desde 5.8 hasta 5.8.11, desde 5.7 hasta 5.7.13, desde 5.6 hasta 5.6.15, desde 5.5 hasta 5.5.16, desde 5.4 hasta 5.4.17, desde 5.3 hasta 5.3.19, desde 5.2 hasta 5.2.22, desde 5.1 hasta 5.1.20, desde 5.0 hasta 5.0.23, desde 4.9 hasta 4.9.27, desde 4.8 hasta 4.8.26, desde 4.7 hasta 4.7.30."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "WordPress",
"product": "WordPress",
"defaultStatus": "unaffected",
"repo": "https://github.com/WordPress/WordPress",
"versions": [
{
"version": "6.8",
"lessThanOrEqual": "6.8.2",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.8.3",
"status": "unaffected"
}
]
},
{
"version": "6.7",
"lessThanOrEqual": "6.7.3",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.7.4",
"status": "unaffected"
}
]
},
{
"version": "6.6",
"lessThanOrEqual": "6.6.3",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.6.4",
"status": "unaffected"
}
]
},
{
"version": "6.5",
"lessThanOrEqual": "6.5.6",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.5.7",
"status": "unaffected"
}
]
},
{
"version": "6.4",
"lessThanOrEqual": "6.4.6",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.4.7",
"status": "unaffected"
}
]
},
{
"version": "6.3",
"lessThanOrEqual": "6.3.6",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.3.7",
"status": "unaffected"
}
]
},
{
"version": "6.2",
"lessThanOrEqual": "6.2.7",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.2.8",
"status": "unaffected"
}
]
},
{
"version": "6.1",
"lessThanOrEqual": "6.1.8",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.1.9",
"status": "unaffected"
}
]
},
{
"version": "6.0",
"lessThanOrEqual": "6.0.10",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.0.11",
"status": "unaffected"
}
]
},
{
"version": "5.9",
"lessThanOrEqual": "5.9.11",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.9.12",
"status": "unaffected"
}
]
},
{
"version": "5.8",
"lessThanOrEqual": "5.8.11",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.8.12",
"status": "unaffected"
}
]
},
{
"version": "5.7",
"lessThanOrEqual": "5.7.13",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.7.14",
"status": "unaffected"
}
]
},
{
"version": "5.6",
"lessThanOrEqual": "5.6.15",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.6.16",
"status": "unaffected"
}
]
},
{
"version": "5.5",
"lessThanOrEqual": "5.5.16",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.5.17",
"status": "unaffected"
}
]
},
{
"version": "5.4",
"lessThanOrEqual": "5.4.17",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.4.18",
"status": "unaffected"
}
]
},
{
"version": "5.3",
"lessThanOrEqual": "5.3.19",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.3.20",
"status": "unaffected"
}
]
},
{
"version": "5.2",
"lessThanOrEqual": "5.2.22",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.2.23",
"status": "unaffected"
}
]
},
{
"version": "5.1",
"lessThanOrEqual": "5.1.20",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.1.21",
"status": "unaffected"
}
]
},
{
"version": "5.0",
"lessThanOrEqual": "5.0.23",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.0.24",
"status": "unaffected"
}
]
},
{
"version": "4.9",
"lessThanOrEqual": "4.9.27",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "4.9.28",
"status": "unaffected"
}
]
},
{
"version": "4.8",
"lessThanOrEqual": "4.8.26",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "4.8.27",
"status": "unaffected"
}
]
},
{
"version": "4.7",
"lessThanOrEqual": "4.7.30",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "4.7.31",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-23T19:15:09.886956Z",
"id": "CVE-2025-58674",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
},
{
"url": "https://wordpress.org/news/2025/09/wordpress-6-8-3-release/",
"source": "[email protected]"
}
]
}