WordPress Vulnerabilities
WP < 6.8.3 - Author+ DOM Stored XSS
Description
WordPress does not escape some data when writting in into the DOM of a page, which could allow users with a role of Author and perform to perform Stored XSS attacks
Affects WordPress
References
Classification
Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
savphill
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2025-09-22 (about 6 months ago)
Added
2025-10-01 (about 5 months ago)
Last Updated
2025-10-01 (about 5 months ago)