WordPress CVE Vulnerabilities — WordPress Plugin Exploits

WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed

medium ✓ patched

cvss score 6.4

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Oct 7, 2026

WordPress Core is vulnerable to Stored Cross-Site Scripting via Imgur embeds in versions 4.7 through 7.1.2 because Imgur is registered as a trusted oEmbed provider and its returned embed HTML is rendered without untrusted-provider sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to store a crafted Imgur embed that can execute web scripts when an affected post is rendered by another user.

WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details

medium ✓ patched

cvss score 4.3

cwe CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

published Oct 7, 2026

WordPress Core is vulnerable to Denial of Service in versions 4.7 through 7.1.2 because WP_Http::make_absolute_url() can enter a non-terminating loop when a malformed relative path contains a parent-directory component that its replacement expression cannot remove. In the demonstrated Core path, this makes it possible for authenticated attackers with Contributor-level access and above to occupy a PHP worker by asking the Block Editor URL Details endpoint to process attacker-controlled remote HTML containing a malformed relative icon or image URL. Repeated concurrent requests may reduce site availability.

WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds

medium ✓ patched

cve id CVE-2026-66666 ↗

cvss score 5.3

cwe CWE-201: Insertion of Sensitive Information Into Sent Data

published Oct 7, 2026

WordPress Core is vulnerable to sensitive information exposure in versions 4.7 through 7.1.2 because singular comment feeds load approved comments before verifying that the associated post is viewable. This makes it possible for unauthenticated attackers to retrieve comments associated with private, draft, or otherwise unpublished posts when the relevant post identifier or slug is known or discovered.

WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type

low ✓ patched

cvss score 3.3

cwe CWE-20: Improper Input Validation

published Oct 7, 2026

WordPress Core is vulnerable to conditional action hook injection in versions 4.7 through 7.1.2 because wp_transition_post_status() constructs status- and post-type-specific action names without first verifying that the supplied status and post type are registered. This makes it possible for attackers who have a separate method of introducing an unregistered status or post type into a post transition to collide with an existing action name and invoke a site-specific callback in an unintended context.

WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API

medium ✓ patched

cvss score 4.3

cwe CWE-863: Incorrect Authorization

published Oct 7, 2026

WordPress Core is vulnerable to unauthorized sticky-post modification in versions 4.7 through 7.1.2 due to an incorrect capability condition in the REST posts controller. This makes it possible for authenticated attackers, with Author-level access and above, to make posts they can edit sticky and, in affected update paths, remove sticky status without possessing the edit_others_posts capability required for sticky-post management.

WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export

medium ✓ patched

cvss score 4.8

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Oct 7, 2026

WordPress Core is vulnerable to second-order SQL Injection in versions 6.5 through 7.1.2 because non-numeric values collected from post thumbnail metadata are concatenated into a later WXR export query. This makes it possible for authenticated attackers, with Author-level access and above and a separate method of storing a crafted _thumbnail_id value, to alter a database query when a privileged user subsequently performs an applicable single-content-type export. The default All content export does not reach the vulnerable branch.

WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments

high ✓ patched

cvss score 7.2

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Oct 6, 2026

WordPress Core is vulnerable to Stored Cross-Site Scripting via pending comments in versions 7.1 through 7.1.2 due to unsafe jQuery handling of attacker-controlled contextual-help tab links. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the Comments administration page that execute when a logged-in user with access to that page clicks the injected link. Approval of the comment is not required.

WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal

high ✓ patched

cve id CVE-2026-87902 ↗

cvss score 8.1

cwe CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

published Sep 22, 2026

WordPress Core is vulnerable to Local File Inclusion via the locate_template() function in various versions up to, and including, 7.1.1. The function resolved a caller-supplied template name against the theme directories without verifying the result stayed within them, so a template name containing '..' could resolve to a readable PHP file outside the active theme and be included. The core-reachable vector is get_page_template(), which builds page-{$pagename}.php from the URL-derived, url-decoded 'pagename' query variable. This makes it possible for unauthenticated attackers to make page-template resolution include a chosen readable local .php file outside the theme directories, which under certain conditions can lead to remote code execution. Exploitation requires (1) the active parent or child theme to contain a top-level directory whose name begins with 'page-' (e.g. 'page-templates' in Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney), and (2) a readable .php target on the server accessible to the web-server account (e.g. pearcmd.php with register_argc_argv=On, as in the official PHP Docker image and default cPanel setups on PHP < 8.5), which yields RCE.

WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route

medium ✓ patched

cvss score 4.3

cwe CWE-1021: Improper Restriction of Rendered UI Layers or Frames

published Sep 17, 2026

WordPress Core's theme installer (theme.js RunInstaller) passed the 'theme' slug from theme-install.php?theme=<slug> into a jQuery attribute selector ($('div[data-slug="'+slug+'"]')) without escaping, and matched any element rather than only theme cards. A crafted URL can automatically install and preview an inactive WordPress.org theme and inject an arbitrary jQuery selector.

WordPress Core <= 7.1 - Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions

medium ✓ patched

cvss score 4.3

cwe CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

published Sep 17, 2026

WordPress Core is vulnerable to Information Exposure via the wp_ajax_sample_permalink() and wp_ajax_get_permalink() AJAX actions in various versions up to, and including, 7.1 due to a missing edit_post capability check on the supplied post ID. This makes it possible for authenticated attackers with Contributor-level access and above to disclose the slug and sample permalink of draft or pending posts authored by other users.

WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data

medium ✓ patched

cvss score 4.4

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Sep 17, 2026

WordPress Core is vulnerable to Stored Cross-Site Scripting via the custom header 'header_image_data' theme mod in various versions up to, and including, 7.1 due to insufficient sanitization of the header image width/height/URL values and an unescaped style attribute in the custom-header admin screen. get_custom_header() returned width/height without integer casting and Custom_Image_Header::step_1() echoed the style string without escaping. This makes it possible for authenticated attackers with edit_theme_options capability to inject web scripts; primarily relevant on Multisite where site administrators lack unfiltered_html.

WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API

medium ✓ patched

cvss score 4.3

cwe CWE-862: Missing Authorization

published Sep 17, 2026

WordPress Core is vulnerable to Missing Authorization via the REST comments controller update_item_permissions_check() in various versions up to, and including, 7.1 because the target post is not authorized when a comment or note's parent post is changed - only the current parent was checked. This makes it possible for an authenticated attacker who can edit a comment (e.g. an Author editing a comment on their own post) to reparent it onto an arbitrary post, including posts they can neither read nor edit.

WordPress Core <= 7.1 - Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()

medium ✓ patched

cvss score 4.3

cwe CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

published Sep 17, 2026

WordPress Core is vulnerable to Information Exposure via the attachment_submitbox_metadata() function in various versions up to, and including, 7.1 due to a missing read_post capability check on an attachment's parent post. This makes it possible for authenticated attackers with upload_files access to view the title of a private or otherwise unreadable parent post to which an attachment is attached.

WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)

medium ✓ patched

cvss score 5.5

cwe CWE-862: Missing Authorization

published Sep 17, 2026

WordPress Core is vulnerable to an authorization bypass via the XML-RPC _insert_post() handler in various versions up to, and including, 7.1 due to internal-only builtin post types such as customize_changeset being writable through the generic post API, bypassing the customizer's per-setting capability enforcement (notably edit_css/unfiltered_css). A user who can create changesets but lacks edit_css can write changeset values including Additional CSS.

WordPress Core <= 7.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite

medium ✓ patched

cvss score 4.3

cwe CWE-639: Authorization Bypass Through User-Controlled Key

published Sep 17, 2026

WordPress Core is vulnerable to Insecure Direct Object Reference via the _wp_translate_postdata() function in various versions up to, and including, 7.1 due to the create path (no post_ID) honoring a raw 'ID' parameter, which wp_insert_post() then treats as an update - bypassing the per-post edit_post capability checks that only run on the update path. This makes it possible for authenticated attackers with Contributor-level access and above to overwrite the content of arbitrary existing posts, including posts authored by higher-privileged users.

WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break

low ✓ patched

cvss score 3.7

cwe CWE-116: Improper Encoding or Escaping of Output

published Sep 17, 2026

WordPress Core's HTML API WP_HTML_Tag_Processor::set_modifiable_text() (since 6.7.0) used an incomplete comment-closer guard (/--!?>/) that missed the '-?>' abrupt-closing form, allowing text set into an HTML comment node to terminate the comment early. This is developer-facing hardening; there is no first-party sink that turns it into a direct vulnerability. Impact is realized only in plugin/theme code that round-trips attacker-controlled text through the HTML API into a comment node.

WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling

high ✓ patched

cve id CVE-2026-93485 ↗

cvss score 7.2

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Sep 17, 2026

WordPress Core is vulnerable to Stored Cross-Site Scripting via the wpautop() function in various versions up to, and including, 7.1 due to a paragraph-unwrapping regular expression ('<p><blockquote([^>]*)>') that mishandles a blockquote whose attribute region contains a '>'. Combined with wpautop's blank-line paragraph splitting, a newline placed inside a blockquote cite value causes a paragraph tag to be relocated into the tag. This makes it possible for unauthenticated attackers to inject web scripts via comment content, though the comment may be subject to moderation approval before it is stored and rendered.

WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller

medium ✓ patched

cvss score 4.3

cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

published Sep 17, 2026

WordPress Core is vulnerable to Path Traversal via the _get_block_template_file() function used by the REST templates controller (/wp/v2/templates/<id>?source=theme) in various versions up to, and including, 7.1 due to the template slug being resolved into a file path without directory containment. Because the route regex forbids '.' but the sanitize callback urldecodes twice, a double-encoded traversal reaches file resolution. This makes it possible for authenticated attackers with Contributor-level access and above to read arbitrary .html files outside the theme template directory.

WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)

low ✓ patched

cvss score 2.7

cwe CWE-862: Missing Authorization

published Sep 17, 2026

WordPress Core is vulnerable to Missing Authorization via the wp_ajax_activate_plugin() AJAX action in various versions up to, and including, 7.1 due to a missing manage_network_plugins capability check when activating a network-only plugin, and a path-normalization mismatch between is_network_only_plugin() and activate_plugin(). This makes it possible for authenticated attackers with site-administrator access on a Multisite network to network-activate an installed network-only plugin.

WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload

high ✓ patched

cve id CVE-2026-65640 ↗

cvss score 8.8

cwe CWE-434: Unrestricted Upload of File with Dangerous Type

published Aug 12, 2026

WordPress Core is vulnerable to Remote Code Execution in multiple release branches, including versions 4.7.0 through 7.0.3. This is due to insufficient validation in the `WP_Image_Editor_Imagick::load()` image-processing path before passing uploaded files or streams to Imagick, which can interpret attacker-supplied image-like files as PostScript-family or compressed delegate formats based on magic bytes, format specifiers, or decompressed content rather than the WordPress-accepted extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload a crafted file that is processed during attachment metadata generation and may trigger unsafe ImageMagick/Ghostscript behavior, resulting in remote code execution on sites using Imagick and Ghostscript. Unauthenticated exploitation is deployment-dependent and requires an additional public-upload plugin or theme path that sends attacker-supplied files through WordPress image metadata generation.

WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery

medium ✓ patched

cvss score 5.8

cwe CWE-918: Server-Side Request Forgery (SSRF)

published Aug 8, 2026

WordPress Core is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 7.0.2 due to insufficient validation of the destination address, as not all reserved and internal IP address ranges are blocked. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to enumerate and interact with internal hosts and services that are otherwise not reachable.

WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds

medium ✓ patched

cvss score 5.3

cwe CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

published Aug 8, 2026

WordPress Core is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0.2 via the comment feeds due to insufficient restrictions on internal notes, which are not excluded from feed output. This makes it possible for unauthenticated attackers to extract the contents of internal notes that should only be available to privileged users.

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element

medium ✓ patched

cvss score 6.4

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Aug 8, 2026

WordPress Core is vulnerable to Stored Cross-Site Scripting via the emoji settings element in all versions up to, and including, 7.0.2 due to insufficient restrictions on submitted post content. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in posts that will execute whenever a user previews the affected post.

WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter

medium ✓ patched

cve id CVE-2026-64638 ↗

cvss score 6.1

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Aug 8, 2026

WordPress Core is vulnerable to Reflected Cross-Site Scripting via the 'log' parameter in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping of the authentication error messages rendered on the login screen. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as visiting a specially crafted, attacker-controlled page that submits a request to the vulnerable site.

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

medium ✓ patched

cvss score 4.9

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Aug 8, 2026

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass

medium ✓ patched

cvss score 4.3

cwe CWE-345: Insufficient Verification of Data Authenticity

published Aug 8, 2026

WordPress Core is vulnerable to an Email Change Confirmation Bypass in all versions up to, and including, 7.0.2 due to inconsistent validation of the new email address when a user profile is updated. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the email address on their account without completing the ownership confirmation step.

WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection

medium ✓ patched

cvss score 5.5

cwe CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

published Aug 8, 2026

WordPress Core is vulnerable to CSS Injection in all versions up to, and including, 7.0.2 due to insufficient sanitization of user supplied CSS. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary CSS into posts, altering the appearance and content of pages rendered for other users.

WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite

medium ✓ patched

cvss score 4.3

cwe CWE-862: Missing Authorization

published Aug 8, 2026

WordPress Core is vulnerable to unauthorized site creation due to a missing check on the active signup policy in the 'gimmeanotherblog' signup action in all versions up to, and including, 7.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new sites on a multisite network that has been configured to allow user registration but not site registration. This issue only affects multisite installations.

WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion

critical ✓ patched

cve id CVE-2026-63030 ↗

cvss score 9.8

cwe CWE-670: Always-Incorrect Control Flow Implementation

published Jul 17, 2026

WordPress Core is vulnerable to Remote Code Execution in all versions 6.9 to 7.0.1 via the REST API batch request endpoint (/wp-json/batch/v1). This is due to a route/validation desynchronization that allows a validated sub-request to be dispatched to an unintended callback, bypassing the allow_batch restriction, with attacker-controlled parameters and the target route's input sanitization bypassed, which can be chained with SQL Injection. This may make it possible for attackers to execute code on the server.

WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter

high ✓ patched

cve id CVE-2026-60137 ↗

cvss score 7.5

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Jul 17, 2026

WordPress Core is vulnerable to generic SQL Injection via the 'author__not_in' parameter in versions 6.8 - 7.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

WordPress <= 6.9.1 - Unauthenticated Blind Server-Side Request Forgery via XML-RPC Pingback Discovery

medium ✓ patched

cvss score 5.8

cwe CWE-918: Server-Side Request Forgery (SSRF)

published Mar 10, 2026

WordPress core is vulnerable to Blind Server-Side Request Forgery in all versions up to and including 6.9.1. This is due to the `WP_HTTP_IXR_Client` class using `wp_remote_post()` instead of the safer `wp_safe_remote_post()` when making outgoing XML-RPC pingback requests. This makes it possible for unauthenticated attackers to make web requests to arbitrary internal locations originating from the WordPress server, which can be used to query and modify information from internal services.

WordPress <= 6.9.1 - Cross-Site Scripting via Client-Side Template Override in Admin Area

medium ✓ patched

cvss score 4.4

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Mar 10, 2026

WordPress core is vulnerable to Cross-Site Scripting via client-side template overriding in the admin area in all versions up to and including 6.9.1. The `wp.template()` JavaScript function uses `document.getElementById()` to locate templates, which matches any HTML element by ID regardless of element type. WordPress admin templates are intended to be `<script type="text/html" id="tmpl-*">` elements, but `getElementById` also matches `<div>`, `<img>`, and other injected elements. If an attacker can inject a non-script element with a matching `tmpl-*` ID, the template content is overridden with attacker-controlled HTML, which is then compiled by Underscore.js `_.template()` with JavaScript execution support. This is a conditional vulnerability that requires an existing HTML injection vector in the admin context.

WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint

medium ✓ patched

cvss score 4.3

cwe CWE-862: Missing Authorization

published Mar 10, 2026

WordPress core is vulnerable to Missing Authorization in all versions up to and including 6.9.1. This is due to a missing capability check on the `uploadedToTitle` and `uploadedToLink` fields in the `wp_prepare_attachment_for_js()` function. When querying media attachments via the AJAX `query-attachments` endpoint, the response includes the parent post's title without verifying whether the current user has `read_post` permission on the parent post. This makes it possible for authenticated attackers with Author-level access to discover the titles of private, draft, and restricted posts that have media attachments.

WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API

medium ✓ patched

cve id CVE-2026-3906 ↗

cvss score 4.3

cwe CWE-862: Missing Authorization

published Mar 10, 2026

WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.

WordPress <= 6.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items

medium ✓ patched

cvss score 4.4

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Mar 10, 2026

WordPress Core is vulnerable to Stored Cross-Site Scripting via admin settings in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload

medium ✓ patched

cvss score 6.5

cwe CWE-611: Improper Restriction of XML External Entity Reference

published Mar 10, 2026

WordPress core is vulnerable to XML External Entity (XXE) Injection via the bundled getID3 library in all versions up to and including 6.9.1. This is due to the `GETID3_LIBXML_OPTIONS` constant including the `LIBXML_NOENT` flag, which enables XML entity substitution during parsing. When WordPress processes media files containing XML metadata (specifically iXML chunks in WAV/RIFF/AVI files), the getID3 library parses the XML with entity substitution enabled, allowing local file disclosure via `file://` protocol URIs. This may make it possible for authenticated attackers with Author-level access to read arbitrary files from the server.

WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure

medium ✓ patched

cve id CVE-2025-58246 ↗

cvss score 4.3

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Sep 22, 2025

WordPress Core is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.8.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract information from posts they should not have access to.

WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting

medium ✓ patched

cve id CVE-2025-58674 ↗

cvss score 6.4

cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

published Sep 22, 2025

WordPress Core is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.