WordPress CVEs

Description

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

Affected WordPress components

• WordPress core
  Confirmed match
  From 6.4.0 (including) to 6.4.3 (including); From 6.5 (including) to 6.5.1 (including); From 6.0 (including) to 6.0.7 (including); From 6.1 (including) to 6.1.5 (including); From 6.2 (including) to 6.2.4 (including); From 6.3 (including) to 6.3.3 (including)
• wordpress Plugin · wordpress
  Possible match Homeless
  From 6.0 (including) to 6.0.7 (including); From 6.1 (including) to 6.1.5 (including); From 6.2 (including) to 6.2.4 (including); From 6.3 (including) to 6.3.3 (including); From 6.4 (including) to 6.4.3 (including); From 6.5 (including) to 6.5.1 (including); From 6.0 (including) to 6.5.1 (including)
  View on WordPress.org
• wordpress Theme · wordpress
  Possible match Homeless
  From 6.0 (including) to 6.0.7 (including); From 6.1 (including) to 6.1.5 (including); From 6.2 (including) to 6.2.4 (including); From 6.3 (including) to 6.3.3 (including); From 6.4 (including) to 6.4.3 (including); From 6.5 (including) to 6.5.1 (including); From 6.0 (including) to 6.5.1 (including)
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• WordPress Foundation WordPress — From 6.0 (including) to 6.0.7 (including)
• WordPress Foundation WordPress — From 6.1 (including) to 6.1.5 (including)
• WordPress Foundation WordPress — From 6.2 (including) to 6.2.4 (including)
• WordPress Foundation WordPress — From 6.3 (including) to 6.3.3 (including)
• WordPress Foundation WordPress — From 6.4 (including) to 6.4.3 (including)
• WordPress Foundation WordPress — From 6.5 (including) to 6.5.1 (including)
• wordpress wordpress — From 6.0 (including) to 6.5.1 (including)
• wordpress wordpress — From 6.0 (including) to 6.0.7 (including)
• wordpress wordpress — From 6.1 (including) to 6.1.5 (including)
• wordpress wordpress — From 6.2 (including) to 6.2.4 (including)
• wordpress wordpress — From 6.3 (including) to 6.3.3 (including)
• wordpress wordpress — From 6.4.0 (including) to 6.4.3 (including)
• wordpress wordpress — From 6.5 (including) to 6.5.1 (including)

References

• core.trac.wordpress.org https://core.trac.wordpress.org/changeset/57951/branches/6.4/src/wp-includes/blocks/avatar.php Patch
• core.trac.wordpress.org https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=57950%40%2F&new=57950%40%2F&sfp_email=&sfph_mail=#file3 Patch
• wordpress.org https://wordpress.org/news/2024/04/wordpress-6-5-2-maintenance-and-security-release/ Vendor Advisory
• www.wordfence.com https://www.wordfence.com/blog/2024/04/unauthenticated-stored-cross-site-scripting-vulnerability-patched-in-wordpress-core/ Exploit, Third Party Advisory
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/e363c09a-4381-4b3a-951c-9a0ff5669016?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record