WordPress 6.3.1

WordPress 6.3.1 has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2025; all 16 are fixed as of August 2026. Their average CVSS score is 5.6, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 8 of the records (50%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Improper Input Validation.

Every one of the 16 issues recorded for WordPress 6.3.1 has a vendor fix available, so running the current release closes all known holes.

13 independent researchers contributed these findings, most of them (3) reported by Rafie Muhammad.

01234567891020.06.2012Today20.06.20123.7WordPress Core - Informational < 6.8 - Weak Hashing Algorithm CVSS 3.7 · 20.06.201204.08.20186.6WordPress Core < 6.4.3 - Authenticated(Administrator+) PHP File Upload CVSS 6.6 · 04.08.201812.10.20236.4WordPress Core 6.3 - 6.3.1 - Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block CVSS 6.4 · 12.10.20236.1WordPress Core 5.6 - 6.3.1 - Reflected Cross-Site Scripting via Application Password Requests CVSS 6.1 · 12.10.20236.4WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes CVSS 6.4 · 12.10.20234.3WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts CVSS 4.3 · 12.10.20235.3WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint CVSS 5.3 · 12.10.20235.3WordPress Core 4.7.0-6.3.1 - Denial of Service via Cache Poisoning CVSS 5.3 · 12.10.20235.4WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode CVSS 5.4 · 12.10.202304.04.20245.3WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink CVSS 5.3 · 04.04.202409.04.20247.2WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block CVSS 7.2 · 09.04.202424.06.20246.4WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API CVSS 6.4 · 24.06.20246.4WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block CVSS 6.4 · 24.06.20244.3WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal CVSS 4.3 · 24.06.202422.09.20254.3WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure CVSS 4.3 · 22.09.20256.4WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 22.09.2025

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage100%
Open

0

Fixed

16

Get automatic notifications for all WordPress 6.3.1 vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2024-4439

WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block

Read the full analysis

Vulnerability Records

16 records
2025-09-22 00:00
WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure
WordPress 6.3.1
4.7 – 6.8.2 · 22 branches
CVE-2025-58246
4.3
Medium
Abu Hurayra (HurayraIIT)Yes
2025-09-22 00:00
WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting
WordPress 6.3.1
4.7 – 6.8.2 · 23 branches
CVE-2025-58674
6.4
Medium
SavPhill (Savphill)Yes
2024-06-24 00:00
WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API
WordPress 6.3.1
5.9 – 6.5.4 · 7 branches
CVE-2024-6307
6.4
Medium
Alex ConchaYes
2024-06-24 00:00
WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block
WordPress 6.3.1
5.9 – 6.5.4 · 7 branches
CVE-2024-31111
6.4
Medium
Rafie MuhammadYes
2024-06-24 00:00
WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal
WordPress 6.3.1
4.1 – 6.5.4 · 26 branches
CVE-2024-32111
4.3
Medium
apple502jYes
2024-04-09 00:00
WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
WordPress 6.3.1
6.0 – 6.5.1 · 6 branches
CVE-2024-4439
7.2
High
John BlackbournYes
2024-04-04 00:00
WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink
WordPress 6.3.1
<= 6.4.3
CVE-2023-5692
5.3
Medium
Francesco CarlucciYes
2023-10-12 00:00
WordPress Core 6.3 - 6.3.1 - Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block
WordPress 6.3.1
6.3 – 6.3.1
N/A
6.4
Medium
Jorge CostaYes
2023-10-12 00:00
WordPress Core 5.6 - 6.3.1 - Reflected Cross-Site Scripting via Application Password Requests
WordPress 6.3.1
5.6 – 6.3.1 · 8 branches
N/A
6.1
Medium
mascara7784Yes
2023-10-12 00:00
WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes
WordPress 6.3.1
5.9 – 6.3.1 · 5 branches
CVE-2023-38000
6.4
Medium
Rafie MuhammadYes
Showing 1–10 of 16 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C