CVE-2024-6305

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6305
Rejected reason: **REJECT** Accidental Reservation making this a duplicate. Please use CVE-2024-31111.
CVSS

No CVSS.

References

No reference.

Configurations

No configuration.

History

25 Jun 2024, 17:15

Type Values Removed Values Added
Summary (en) WordPress Core is vulnerable to Stored Cross-Site Scripting via the Template Part Block in various versions up to 6.5.5 due to insufficient input sanitization and output escaping on the 'tagName' attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. (en) Rejected reason: **REJECT** Accidental Reservation making this a duplicate. Please use CVE-2024-31111.
References
  • {'url': 'https://core.trac.wordpress.org/changeset/58471', 'source': 'security@wordfence.com'}
  • {'url': 'https://wordpress.org/news/2024/06/wordpress-6-5-5/', 'source': 'security@wordfence.com'}
  • {'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/2a225ccb-a7dc-4437-bd97-b309d6ae6a47?source=cve', 'source': 'security@wordfence.com'}
CVSS v2 : unknown
v3 : 6.4 		v2 : unknown
v3 : unknown

25 Jun 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-25 11:15

Updated : 2024-06-25 17:15

NVD link : CVE-2024-6305

Mitre link : CVE-2024-6305

CVE.ORG link : CVE-2024-6305

JSON object : View

Products Affected

No product.

CWE

No CWE.