VulnerableCode Package Details - pkg:deb/debian/wordpress@6.1.6%2Bdfsg1-0%2Bdeb12u1

Search for packages

Vulnerability	Summary	Fixed by
VCID-2bv7-vxb4-ybh8 Aliases: CVE-2023-5692	WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.	6.8.1+dfsg1-1 Affected by 0 other vulnerabilities.
VCID-5ajy-ezh3-vkct Aliases: CVE-2024-6307	WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	6.8.1+dfsg1-1 Affected by 0 other vulnerabilities.
VCID-826u-hftn-63b7 Aliases: CVE-2012-6707		6.8.1+dfsg1-1 Affected by 0 other vulnerabilities.
VCID-qffj-kjmq-4uaj Aliases: CVE-2024-31111	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.	6.8.1+dfsg1-1 Affected by 0 other vulnerabilities.
VCID-u4na-zqaw-6kec Aliases: CVE-2024-4439	WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.	6.8.1+dfsg1-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-2bv7-vxb4-ybh8
Aliases:
CVE-2023-5692

WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.