CVE-2024-31111

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.

Score

CVSS 3.1 6.5 Medium

Status

Deferred - audit@patchstack.com

Published

2024-06-25

Last modified

2026-04-28

Weaknesses

CWE-79

Affected products

• Wordpress (Automattic)

References

• https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-5-5-cross-site-scripting-xss-vi…
• https://wordpress.org/news/2024/06/wordpress-6-5-5/