6.5
Medium
CVE-2024-31111 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in…
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress 6.5 | 6.5 → 6.5.4 | No fix stated |
| WordPress 6.4 | 6.4 → 6.4.4 | No fix stated |
| WordPress 6.3 | 6.3 → 6.3.4 | No fix stated |
| WordPress 6.2 | 6.2 → 6.2.5 | No fix stated |
| WordPress 6.1 | 6.1 → 6.1.6 | No fix stated |
| WordPress 6.0 | 6.0 → 6.0.8 | No fix stated |
| WordPress 5.9 | 5.9 → 5.9.9 | No fix stated |
Other CVEs of WordPress
The 4 CVEs of WordPress →
CVE-2026-66666
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded…
6.9
Medium
CVE-2026-93485
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic…
7.1
High
CVE-2024-32111
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress…
5.0
Medium