PT-2024-23781 · WordPress+1 · Wordpress+1

Rafie Muhammad · Published 2024-06-25 · Updated 2025-12-10 · CVE-2024-31111

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WordPress versions 5.9 through 5.9.9 WordPress versions 6.0 through 6.0.8 WordPress versions 6.1 through 6.1.6 WordPress versions 6.2 through 6.2.5 WordPress versions 6.3 through 6.3.4 WordPress versions 6.4 through 6.4.4 WordPress versions 6.5 through 6.5.4

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS) or Stored XSS. This allows for the storage of malicious scripts in the website, which can then be executed by other users, potentially leading to unauthorized actions or data theft.

Recommendations For WordPress versions 5.9 through 5.9.9, update to a version outside of this range to resolve the issue. For WordPress versions 6.0 through 6.0.8, update to a version outside of this range to resolve the issue. For WordPress versions 6.1 through 6.1.6, update to a version outside of this range to resolve the issue. For WordPress versions 6.2 through 6.2.5, update to a version outside of this range to resolve the issue. For WordPress versions 6.3 through 6.3.4, update to a version outside of this range to resolve the issue. For WordPress versions 6.4 through 6.4.4, update to a version outside of this range to resolve the issue. For WordPress versions 6.5 through 6.5.4, update to a version outside of this range to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-WORDPRESS-2024-31111

BIT-WORDPRESS-MULTISITE-2024-31111

CVE-2024-31111

DLA-4358-1

DSA-6075-1

Affected Products

Debian

Wordpress

References · 15

• https://security-tracker.debian.org/tracker/CVE-2024-31111 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-2024-31111 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-31111 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-31111 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-31111 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31111 · Security Note
• https://osv.dev/vulnerability/DLA-4358-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-31111 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2024-31111 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6075-1 · Vendor Advisory
• https://t.me/cvenotify/84350 · Telegram Post
• https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-5-5-cross-site-scripting-xss-via-template-part-vulnerability?_s_id=cve · Note
• https://wordpress.org/news/2024/06/wordpress-6-5-5 · Note
• https://t.me/cvenotify/84373 · Telegram Post