Stored cross-site scripting in WordPress - CVE-2025-58674
Published: October 7, 2025 / Updated: December 23, 2025
Vulnerability identifier: #VU116652
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-58674
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when handling nav menus. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Affected software
WordPress
Debian Linux
wordpress (Debian package)
Debian Linux
wordpress (Debian package)
How to mitigate CVE-2025-58674
Install updates from vendor's website.
WordPress - addressed in versions 4.7.31, 4.8.27, 4.9.28, 5.0.24, 5.1.21, 5.2.23, 5.3.20, 5.4.18, 5.5.17, 5.6.16, 5.7.14, 5.8.12, 5.9.12, 6.0.11, 6.1.9, 6.2.8, 6.3.7, 6.4.7, 6.5.7, 6.6.4, 6.7.4, 6.8.3
wordpress (Debian package) - update to 6.8.3+dfsg1-0+deb13u1
wordpress (Debian package) - update to 6.8.3+dfsg1-0+deb13u1