CVE-2025-58674: WordPress Stored XSS Vulnerability

CVE-2025-58674 Overview

CVE-2025-58674 is a stored Cross-Site Scripting (XSS) vulnerability in WordPress core, tracked under [CWE-79]. The flaw allows authenticated users with Author-level privileges or higher to inject malicious scripts that execute in the browsers of other users viewing the affected content. The vulnerability affects a wide range of WordPress versions spanning from 4.7 through 6.8.2. WordPress addressed the issue in the 6.8.3 maintenance release. Exploitation requires user interaction and elevated privileges, which limits mass exploitation but preserves risk for multi-author sites and hosted platforms.

Critical Impact
An authenticated attacker with Author or higher privileges can inject persistent JavaScript that executes against administrators and site visitors, enabling session theft, privilege escalation, and content manipulation.

Affected Products

WordPress 6.8 through 6.8.2, 6.7 through 6.7.3, 6.6 through 6.6.3
WordPress 6.5 through 6.5.6, 6.4 through 6.4.6, 6.3 through 6.3.6, 6.2 through 6.2.7, 6.1 through 6.1.8, 6.0 through 6.0.10
WordPress 5.x branches from 5.0 through 5.9.11, and legacy branches 4.7 through 4.9.27

Discovery Timeline

2025-09-23 - CVE CVE-2025-58674 published to NVD
2025-09 - WordPress 6.8.3 maintenance release published addressing the issue
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58674

Vulnerability Analysis

The vulnerability is a stored XSS issue in WordPress core content handling. WordPress fails to properly neutralize user-supplied input during web page generation, allowing script payloads submitted by an authenticated author to persist in the database. When another user renders the affected page, the browser interprets the injected payload as executable JavaScript in the origin of the WordPress site. Because the payload is stored, it executes repeatedly for every visitor to the affected content, including administrators.

Root Cause

The root cause is improper output escaping or input sanitization within a WordPress core content pathway accessible to Author-role users. Author-level accounts have legitimate access to publishing capabilities such as post content, media metadata, and related fields. The absence of a strict escaping routine on one of these fields permits HTML and JavaScript to reach rendered pages unfiltered. The WordPress security team confirmed the issue and shipped a fix in 6.8.3 alongside back-ported patches to supported branches.

Attack Vector

The attack requires network access to the WordPress site and an existing Author, Editor, or Administrator account. The attacker crafts content containing a malicious script payload and stores it through a legitimate publishing workflow. A privileged user must then view the injected content to trigger execution. The scope is changed because scripts executing in an administrator session can perform actions with elevated privileges, including creating new administrator accounts, modifying plugins, or exfiltrating nonces. No public proof-of-concept or exploitation in the wild has been reported.

No verified exploit code is available. Refer to the Patchstack WordPress XSS Vulnerability advisory for further technical detail.

Detection Methods for CVE-2025-58674

Indicators of Compromise

Post, page, or comment content containing <script>, onerror=, onload=, javascript:, or encoded equivalents in fields rendered to other users.
Unexpected creation of administrator accounts or role changes shortly after an Author account authored or edited content.
Outbound requests from administrator browsers to unfamiliar domains immediately after visiting authored content.

Detection Strategies

Query the wp_posts, wp_postmeta, and wp_comments tables for script-like patterns in content authored by non-administrator users.
Review WordPress audit logs for role escalations, plugin installations, or option changes correlated with Author account activity.
Inspect web server access logs for suspicious request patterns to admin-ajax.php or wp-json endpoints originating from administrator sessions.

Monitoring Recommendations

Enable a Content Security Policy (CSP) that reports script-source violations to a monitored endpoint.
Monitor for new Author, Editor, or Administrator account creation and correlate with content edits.
Alert on modifications to core files, wp-config.php, and installed plugin directories.

How to Mitigate CVE-2025-58674

Immediate Actions Required

Upgrade WordPress to 6.8.3 or the corresponding patched release for older supported branches.
Audit all Author, Editor, and Administrator accounts and revoke any that are unused or unrecognized.
Review recent posts, pages, and comments authored by non-administrator users for suspicious HTML or JavaScript.

Patch Information

WordPress released version 6.8.3 to address CVE-2025-58674, with back-ported fixes for supported legacy branches. Details are published in the WordPress 6.8.3 Release Announcement. Sites configured for automatic background updates on minor releases receive the fix automatically. Managed hosting providers may have already applied the patch on customers' behalf.

Workarounds

Restrict the Author role to trusted users only, and require multi-factor authentication for all content contributors.
Deploy a web application firewall (WAF) rule set that blocks common XSS payload patterns in POST bodies to wp-admin endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on rendered pages.

bash

# Configuration example: verify WordPress version and update via WP-CLI
wp core version
wp core update --version=6.8.3
wp core update-db