Medium severity6.4NVD Advisory· Published Jun 25, 2024· Updated Apr 15, 2026

CVE-2024-6307

Description

WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products

WordPress/Coreinferred
Range: <6.5.5
Package: https://wordpress.org/plugins/core
osv-coords2 versions
pkg:bitnami/wordpress pkg:bitnami/wordpress-multisite
>= 5.9.0, < 5.9.10+ 1 more
- (no CPE)range: >= 5.9.0, < 5.9.10
- (no CPE)range: >= 5.9.0, < 5.9.10

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

core.trac.wordpress.org/changeset/58472nvd
core.trac.wordpress.org/changeset/58473nvd
wordpress.org/news/2024/06/wordpress-6-5-5/nvd
www.wordfence.com/threat-intel/vulnerabilities/id/bc0d36f8-6569-49a1-b722-5cf57c4bb32anvd

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000