PT-2025-39206 · Automattic+1 · Wordpress+1

John Blackbourn + 1 · Published 2025-09-22 · Updated 2025-12-21 · CVE-2025-58674

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions through 6.8.2

Description A flaw exists in Automattic WordPress that allows for Stored Cross-site Scripting (XSS). An attacker with Author or higher user privileges can exploit this issue. The vulnerability stems from improper neutralization of input during web page generation.

Recommendations Update WordPress to a version later than 6.8.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-13139

BIT-WORDPRESS-2025-58674

BIT-WORDPRESS-MULTISITE-2025-58674

CVE-2025-58674

DLA-4358-1

DSA-6075-1

DSA-6091-1

Affected Products

Debian

Wordpress

References · 17

• https://ubuntu.com/security/CVE-2025-58674 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-58674 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13139 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-58674 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58674 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-58674 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2025-58674 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-58674 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4358-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6075-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-2025-58674 · Vendor Advisory
• https://wordpress.org/news/2025/09/wordpress-6-8-3-release · Note
• https://twitter.com/CVEnew/status/1970621786334339130 · Twitter Post
• https://t.me/CVEtracker/33195 · Telegram Post
• https://patchstack.com/database/Wordpress/Wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve · Note