« Back to list

CVE-2024-31111

Status: DeferredMedium (6.5)—

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Wordpress — WordpressAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2024-31111",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-31111",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-25T13:49:17.784337Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "audit@patchstack.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "audit@patchstack.com",
      "affectedData": [
        {
          "vendor": "Automattic",
          "product": "WordPress",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.5.5",
                  "status": "unaffected"
                }
              ],
              "version": "6.5",
              "versionType": "custom",
              "lessThanOrEqual": "6.5.4"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.4.5",
                  "status": "unaffected"
                }
              ],
              "version": "6.4",
              "versionType": "custom",
              "lessThanOrEqual": "6.4.4"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.3.5",
                  "status": "unaffected"
                }
              ],
              "version": "6.3",
              "versionType": "custom",
              "lessThanOrEqual": "6.3.4"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.2.6",
                  "status": "unaffected"
                }
              ],
              "version": "6.2",
              "versionType": "custom",
              "lessThanOrEqual": "6.2.5"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.1.7",
                  "status": "unaffected"
                }
              ],
              "version": "6.1",
              "versionType": "custom",
              "lessThanOrEqual": "6.1.6"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.0.9",
                  "status": "unaffected"
                }
              ],
              "version": "6.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.0.8"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "5.9.10",
                  "status": "unaffected"
                }
              ],
              "version": "5.9",
              "versionType": "custom",
              "lessThanOrEqual": "5.9.9"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-06-25T13:15:49.383",
  "references": [
    {
      "url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-5-5-cross-site-scripting-xss-via-template-part-vulnerability?_s_id=cve",
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/",
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-5-5-cross-site-scripting-xss-via-template-part-vulnerability?_s_id=cve",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "audit@patchstack.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en Automattic WordPress permite almacenar XSS. Este problema afecta a WordPress: de 6.5 a 6.5.4, de 6.4 a 6.4.4, de 6.3 a 6.3. 4, del 6.2 al 6.2.5, del 6.1 al 6.1.6, del 6.0 al 6.0.8, del 5.9 al 5.9.9."
    }
  ],
  "lastModified": "2026-06-17T07:27:49.150",
  "sourceIdentifier": "audit@patchstack.com"
}