Stored XSS Vulnerability in WordPress - CVE-2025-58674
Summary
DEBIAN-CVE-2025-58674: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS. Affects wordpress versions 5.7.1+dfsg1-2 – 6.8.1+dfsg1-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WordPress is a widely-used open-source content management system (CMS) that allows users to create and manage websites easily. It offers a range of features, including customizable themes, plugins, and a user-friendly interface. However, like any software, WordPress is susceptible to vulnerabilities. The CVE-2025-58674 vulnerability specifically affects WordPress versions from n/a through 6.8.2, allowing attackers with Author or higher privileges to exploit stored cross-site scripting (XSS) issues.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, leading to stored XSS. This means that an attacker can inject malicious scripts that are stored on the server and executed when users visit the affected page. The potential ramifications include unauthorized access to user data, session hijacking, and defacement of websites. The WordPress core security team is aware of the issue and is actively working on a fix.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the privileges of users who have Author or higher roles until the patch is released. This can be done by adjusting user roles in the WordPress admin panel.
Conclusion
The CVE-2025-58674 vulnerability in WordPress poses a risk of stored XSS attacks, particularly for users with Author or higher privileges. It is crucial for WordPress users to stay informed about updates and apply patches promptly to maintain the security of their websites.
See every vulnerability recorded for wordpress →
FAQ
CVE-2025-58674 is a stored XSS vulnerability in WordPress that allows attackers with Author or higher privileges to inject malicious scripts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider limiting user privileges for those who can execute the attack until a patch is available.
While it is classified as low severity, it can lead to significant issues if exploited, including unauthorized access to sensitive data.
It is recommended to check for updates regularly, ideally at least once a week, to ensure your site is secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
