Skip to content
OpenAdvisories
Medium · 5.9 CVE-2025-58674 EUVD-2025-30923GHSA-73p8-vhmr-7r6r

WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

Published Sep 23, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.

Affected products

VendorProductAffectedFixed
WordPress WordPress 6.8 – ≤ 6.8.2, 6.7 – ≤ 6.7.3, 6.6 – ≤ 6.6.3, 6.5 – ≤ 6.5.6, 6.4 – ≤ 6.4.6, 6.3 – ≤ 6.3.6, 6.2 – ≤ 6.2.7, 6.1 – ≤ 6.1.8, 6.0 – ≤ 6.0.10, 5.9 – ≤ 5.9.11, 5.8 – ≤ 5.8.11, 5.7 – ≤ 5.7.13, 5.6 – ≤ 5.6.15, 5.5 – ≤ 5.5.16, 5.4 – ≤ 5.4.17, 5.3 – ≤ 5.3.19, 5.2 – ≤ 5.2.22, 5.1 – ≤ 5.1.20, 5.0 – ≤ 5.0.23, 4.9… —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 wordpress 6.8.3+dfsg1-1 —
Debian 13 wordpress 6.8.3+dfsg1-0+deb13u1 DSA-6091-1
Debian 12 wordpress 6.1.9+dfsg1-0+deb12u1 DSA-6075-1
Debian 11 wordpress 5.7.14+dfsg1-0+deb11u1 DLA-4358-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wordpress No fix yet —
Ubuntu 26.04 LTS wordpress No fix yet —
Ubuntu 25.10 wordpress No fix yet —
Ubuntu 24.04 LTS wordpress No fix yet —
Ubuntu 22.04 LTS wordpress No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wordpress No fix yet —
Ubuntu 18.04 LTS wordpress No fix yet —
Ubuntu 16.04 LTS wordpress No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling wordpress-oci-entrypoint 6.8.3-r0 —

Advisories 4

References