Medium severity · published Jun 25, 2024
CVE-2024-31111
WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WordPress · Automattic
6.5 through 6.5.4; 6.4 through 6.4.4; 6.3 through 6.3.4; 6.2 through 6.2.5; 6.1 through 6.1.6; 6.0 through 6.0.8; +1 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31111
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31111
patchstack.com
https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-5-5-cross-site-scripting-xss-via-template-part-vulnerability?_s_id=cve
wordpress.org
https://wordpress.org/news/2024/06/wordpress-6-5-5/
More from WordPress
7.1
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
6.9
CVE-2026-66666
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
5.0
CVE-2024-32111
WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability