Homepage

Cross-site Scripting (XSS) Affecting wordpress package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN11-WORDPRESS-13045803
  • published25 Sept 2025
  • disclosed23 Sept 2025
Report a new vulnerability Found a mistake?

Introduced: 23 Sep 2025

NewCVE-2025-58674  (opens in a new tab)
CWE-79  (opens in a new tab)

How to fix?

There is no fixed version for Debian:11 wordpress.

NVD Description

Note: Versions mentioned in the description apply only to the upstream wordpress package and not the wordpress package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.

WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector. This issue affects WordPress: from n/a through 6.8.2.