Description
Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WordPress.org | WordPress | 6.3 – ≤ 6.3.1, 6.2 – ≤ 6.2.2, 6.1 – ≤ 6.1.3, 6.0 – ≤ 6.0.5, 5.9 – ≤ 5.9.7 | — |
| Gutenberg Team | Gutenberg | ≤ 16.8.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 6.3.2+dfsg1-1 | — |
| Debian 13 | wordpress | 6.3.2+dfsg1-1 | — |
| Debian 12 | wordpress | 6.1.6+dfsg1-0+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | wordpress | No fix yet | — |
| Ubuntu 26.04 LTS | wordpress | No fix yet | — |
| Ubuntu 25.10 | wordpress | No fix yet | — |
| Ubuntu 24.04 LTS | wordpress | No fix yet | — |
| Ubuntu 22.04 LTS | wordpress | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | wordpress | No fix yet | — |
| Ubuntu 18.04 LTS | wordpress | No fix yet | — |
| Ubuntu 16.04 LTS | wordpress | No fix yet | — |
Advisories 1
- WID-SEC-2023-2640 WordPress: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 9, 2024
References
- https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve third-party-advisory
- https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-3-2-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/gutenberg/wordpress-gutenberg-plugin-16-8-0-contributor-stored-xss-in-navigation-links-block-vulnerability?_s_id=cve vdb-entry