WordPress 6.0.4

WordPress 6.0.4 has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2025; all 16 are fixed as of August 2026. Their average CVSS score is 5.6, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (44%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Acceptance Of Extraneous Untrusted Data With Trusted Data.

Every one of the 16 issues recorded for WordPress 6.0.4 has a vendor fix available, so running the current release closes all known holes.

13 independent researchers contributed these findings, most of them (3) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSMedium

5.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WordPress 6.0.4 vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2024-4439

WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block

Read the full analysis

Vulnerability Records

16 records


2025-09-22 00:00	WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure WordPress 6.0.4 4.7 – 6.8.2 · 22 branches	`CVE-2025-58246`	4.3 Medium	Abu Hurayra (HurayraIIT)	Yes
2025-09-22 00:00	WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting WordPress 6.0.4 4.7 – 6.8.2 · 23 branches	`CVE-2025-58674`	6.4 Medium	SavPhill (Savphill)	Yes
2024-06-24 00:00	WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API WordPress 6.0.4 5.9 – 6.5.4 · 7 branches	`CVE-2024-6307`	6.4 Medium	Alex Concha	Yes
2024-06-24 00:00	WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block WordPress 6.0.4 5.9 – 6.5.4 · 7 branches	`CVE-2024-31111`	6.4 Medium	Rafie Muhammad	Yes
2024-06-24 00:00	WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal WordPress 6.0.4 4.1 – 6.5.4 · 26 branches	`CVE-2024-32111`	4.3 Medium	apple502j	Yes
2024-04-09 00:00	WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block WordPress 6.0.4 6.0 – 6.5.1 · 6 branches	`CVE-2024-4439`	7.2 High	John Blackbourn	Yes
2024-04-04 00:00	WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink WordPress 6.0.4 <= 6.4.3	`CVE-2023-5692`	5.3 Medium	Francesco Carlucci	Yes
2023-10-12 00:00	WordPress Core 5.6 - 6.3.1 - Reflected Cross-Site Scripting via Application Password Requests WordPress 6.0.4 5.6 – 6.3.1 · 8 branches	`N/A`	6.1 Medium	mascara7784	Yes
2023-10-12 00:00	WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes WordPress 6.0.4 5.9 – 6.3.1 · 5 branches	`CVE-2023-38000`	6.4 Medium	Rafie Muhammad	Yes
2023-10-12 00:00	WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts WordPress 6.0.4 4.1.38 – 6.3.1 · 23 branches	`CVE-2023-39999`	4.3 Medium	Rafie Muhammad	Yes

Showing 1–10 of 16 reports