{"schema_version":"2","view":"grouped","data":[{"id":60364,"cve_ids":["CVE-2026-87902"],"payload":{"kind":"advisory","title":"CVE-2026-87902","summary":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","evidence":"cve:CVE-2026-87902","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-87902","aliases":["CVE-2026-87902"],"metrics":[],"affected":[{"vendor":"WordPress","product":"WordPress","versions":[{"status":"affected","version":"0","lessThan":"7.1.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-26T03:55:51.560Z","provider":"cve","references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-87902","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T00:00:00+00:00"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-09-25","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902"}}}],"timeline":[{"lang":"en","time":"2026-09-25T00:00:00.000Z","value":"CVE-2026-87902 added to CISA KEV"}],"references":[{"url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","tags":["third-party-advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902","tags":["government-resource"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-26T03:55:51.560Z"}}],"cna":{"orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","shortName":"hackerone","dateUpdated":"2026-09-22T16:44:15.048Z"}}},"related_cves":[{"value":"CVE-2026-87902","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9f4e2723-2bb9-480d-9d31-a4dcf93142bd","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress-multisite","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-multisite-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":3,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87902","advisory_id":"9f4e2723-2bb9-480d-9d31-a4dcf93142bd","event_types":["advisory"],"published_at":"2026-10-25T18:32:57.157842+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T16:44:15.048+00:00","detail_url":"/advisories/advisory%3A9f4e2723-2bb9-480d-9d31-a4dcf93142bd","group":{"id":"advisory:9f4e2723-2bb9-480d-9d31-a4dcf93142bd","revision":1,"primary_event_id":59567,"change":"published","superseded_by":[],"changed":{"id":59567,"cve_ids":["CVE-2026-87902"],"payload":{"kind":"advisory","title":"CVE-2026-87902","summary":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","evidence":"cve:CVE-2026-87902","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-87902","aliases":["CVE-2026-87902"],"metrics":[],"affected":[{"vendor":"WordPress","product":"WordPress","versions":[{"status":"affected","version":"0","lessThan":"7.1.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-26T03:55:51.560Z","provider":"cve","references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-87902","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T00:00:00+00:00"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-09-25","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902"}}}],"timeline":[{"lang":"en","time":"2026-09-25T00:00:00.000Z","value":"CVE-2026-87902 added to CISA KEV"}],"references":[{"url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","tags":["third-party-advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902","tags":["government-resource"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-26T03:55:51.560Z"}}],"cna":{"orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","shortName":"hackerone","dateUpdated":"2026-09-22T16:44:15.048Z"}}},"related_cves":[{"value":"CVE-2026-87902","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9f4e2723-2bb9-480d-9d31-a4dcf93142bd","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress-multisite","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-multisite-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":3,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87902","advisory_id":"9f4e2723-2bb9-480d-9d31-a4dcf93142bd","event_types":["advisory"],"published_at":"2026-10-25T18:32:57.157842+00:00","technologies":["core-cve","wordpress"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-22T16:44:15.048+00:00","detail_url":"/events/59567"},"members":[{"id":59567,"cve_ids":["CVE-2026-87902"],"payload":{"kind":"advisory","title":"CVE-2026-87902","summary":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","evidence":"cve:CVE-2026-87902","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-87902","aliases":["CVE-2026-87902"],"metrics":[],"affected":[{"vendor":"WordPress","product":"WordPress","versions":[{"status":"affected","version":"0","lessThan":"7.1.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-26T03:55:51.560Z","provider":"cve","references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-87902","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T00:00:00+00:00"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-09-25","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902"}}}],"timeline":[{"lang":"en","time":"2026-09-25T00:00:00.000Z","value":"CVE-2026-87902 added to CISA KEV"}],"references":[{"url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","tags":["third-party-advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902","tags":["government-resource"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-26T03:55:51.560Z"}}],"cna":{"orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","shortName":"hackerone","dateUpdated":"2026-09-22T16:44:15.048Z"}}},"related_cves":[{"value":"CVE-2026-87902","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9f4e2723-2bb9-480d-9d31-a4dcf93142bd","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress-multisite","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-multisite-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":3,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87902","advisory_id":"9f4e2723-2bb9-480d-9d31-a4dcf93142bd","event_types":["advisory"],"published_at":"2026-10-25T18:32:57.157842+00:00","technologies":["core-cve","wordpress"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-22T16:44:15.048+00:00","detail_url":"/events/59567"}]}},{"id":52784,"cve_ids":["CVE-2026-114570"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit","summary":"WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.","evidence":"cve:CVE-2026-114570","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114570","aliases":["CVE-2026-114570"],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"}}],"affected":[{"vendor":"WordPress Foundation","product":"WordPress","versions":[{"status":"affected","version":"4.7.0","versionType":"semver","lessThanOrEqual":"4.7.33"},{"status":"affected","version":"4.8.0","versionType":"semver","lessThanOrEqual":"4.8.28"},{"status":"affected","version":"4.9.0","versionType":"semver","lessThanOrEqual":"4.9.29"},{"status":"affected","version":"5.0.0","versionType":"semver","lessThanOrEqual":"5.0.25"},{"status":"affected","version":"5.1.0","versionType":"semver","lessThanOrEqual":"5.1.22"},{"status":"affected","version":"5.2.0","versionType":"semver","lessThanOrEqual":"5.2.24"},{"status":"affected","version":"5.3.0","versionType":"semver","lessThanOrEqual":"5.3.21"},{"status":"affected","version":"5.4.0","versionType":"semver","lessThanOrEqual":"5.4.19"},{"status":"affected","version":"5.5.0","versionType":"semver","lessThanOrEqual":"5.5.18"},{"status":"affected","version":"5.6.0","versionType":"semver","lessThanOrEqual":"5.6.17"},{"status":"affected","version":"5.7.0","versionType":"semver","lessThanOrEqual":"5.7.15"},{"status":"affected","version":"5.8.0","versionType":"semver","lessThanOrEqual":"5.8.13"},{"status":"affected","version":"5.9.0","versionType":"semver","lessThanOrEqual":"5.9.13"},{"status":"affected","version":"6.0.0","versionType":"semver","lessThanOrEqual":"6.0.12"},{"status":"affected","version":"6.1.0","versionType":"semver","lessThanOrEqual":"6.1.10"},{"status":"affected","version":"6.2.0","versionType":"semver","lessThanOrEqual":"6.2.9"},{"status":"affected","version":"6.3.0","versionType":"semver","lessThanOrEqual":"6.3.8"},{"status":"affected","version":"6.4.0","versionType":"semver","lessThanOrEqual":"6.4.8"},{"status":"affected","version":"6.5.0","versionType":"semver","lessThanOrEqual":"6.5.8"},{"status":"affected","version":"6.6.0","versionType":"semver","lessThanOrEqual":"6.6.5"},{"status":"affected","version":"6.7.0","versionType":"semver","lessThanOrEqual":"6.7.5"},{"status":"affected","version":"6.8.0","versionType":"semver","lessThanOrEqual":"6.8.6"},{"status":"affected","version":"6.9.0","versionType":"semver","lessThanOrEqual":"6.9.5"},{"status":"affected","version":"7.0.0","versionType":"semver","lessThanOrEqual":"7.0.2"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T19:10:33.995Z","provider":"cve","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve","https://wordpress.org/news/2026/08/wordpress-7-0-3-release/","https://core.trac.wordpress.org/changeset/63061"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114570","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-22T13:33:19.865820Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T19:10:33.995Z"}}],"cna":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-10-22T05:29:48.488Z"}}},"related_cves":[{"value":"CVE-2026-114570","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:48ce7a1b-7970-4ba2-b10a-3351796d5867","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114570","advisory_id":"48ce7a1b-7970-4ba2-b10a-3351796d5867","event_types":["advisory"],"published_at":"2026-10-25T14:42:42.119675+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T05:29:48.488+00:00","detail_url":"/advisories/advisory%3A48ce7a1b-7970-4ba2-b10a-3351796d5867","group":{"id":"advisory:48ce7a1b-7970-4ba2-b10a-3351796d5867","revision":1,"primary_event_id":52312,"change":"published","superseded_by":[],"changed":{"id":52312,"cve_ids":["CVE-2026-114570"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit","summary":"WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.","evidence":"cve:CVE-2026-114570","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114570","aliases":["CVE-2026-114570"],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"}}],"affected":[{"vendor":"WordPress Foundation","product":"WordPress","versions":[{"status":"affected","version":"4.7.0","versionType":"semver","lessThanOrEqual":"4.7.33"},{"status":"affected","version":"4.8.0","versionType":"semver","lessThanOrEqual":"4.8.28"},{"status":"affected","version":"4.9.0","versionType":"semver","lessThanOrEqual":"4.9.29"},{"status":"affected","version":"5.0.0","versionType":"semver","lessThanOrEqual":"5.0.25"},{"status":"affected","version":"5.1.0","versionType":"semver","lessThanOrEqual":"5.1.22"},{"status":"affected","version":"5.2.0","versionType":"semver","lessThanOrEqual":"5.2.24"},{"status":"affected","version":"5.3.0","versionType":"semver","lessThanOrEqual":"5.3.21"},{"status":"affected","version":"5.4.0","versionType":"semver","lessThanOrEqual":"5.4.19"},{"status":"affected","version":"5.5.0","versionType":"semver","lessThanOrEqual":"5.5.18"},{"status":"affected","version":"5.6.0","versionType":"semver","lessThanOrEqual":"5.6.17"},{"status":"affected","version":"5.7.0","versionType":"semver","lessThanOrEqual":"5.7.15"},{"status":"affected","version":"5.8.0","versionType":"semver","lessThanOrEqual":"5.8.13"},{"status":"affected","version":"5.9.0","versionType":"semver","lessThanOrEqual":"5.9.13"},{"status":"affected","version":"6.0.0","versionType":"semver","lessThanOrEqual":"6.0.12"},{"status":"affected","version":"6.1.0","versionType":"semver","lessThanOrEqual":"6.1.10"},{"status":"affected","version":"6.2.0","versionType":"semver","lessThanOrEqual":"6.2.9"},{"status":"affected","version":"6.3.0","versionType":"semver","lessThanOrEqual":"6.3.8"},{"status":"affected","version":"6.4.0","versionType":"semver","lessThanOrEqual":"6.4.8"},{"status":"affected","version":"6.5.0","versionType":"semver","lessThanOrEqual":"6.5.8"},{"status":"affected","version":"6.6.0","versionType":"semver","lessThanOrEqual":"6.6.5"},{"status":"affected","version":"6.7.0","versionType":"semver","lessThanOrEqual":"6.7.5"},{"status":"affected","version":"6.8.0","versionType":"semver","lessThanOrEqual":"6.8.6"},{"status":"affected","version":"6.9.0","versionType":"semver","lessThanOrEqual":"6.9.5"},{"status":"affected","version":"7.0.0","versionType":"semver","lessThanOrEqual":"7.0.2"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T19:10:33.995Z","provider":"cve","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve","https://wordpress.org/news/2026/08/wordpress-7-0-3-release/","https://core.trac.wordpress.org/changeset/63061"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114570","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-22T13:33:19.865820Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T19:10:33.995Z"}}],"cna":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-10-22T05:29:48.488Z"}}},"related_cves":[{"value":"CVE-2026-114570","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:48ce7a1b-7970-4ba2-b10a-3351796d5867","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114570","advisory_id":"48ce7a1b-7970-4ba2-b10a-3351796d5867","event_types":["advisory"],"published_at":"2026-10-25T14:42:42.119675+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T05:29:48.488+00:00","detail_url":"/events/52312"},"members":[{"id":52312,"cve_ids":["CVE-2026-114570"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit","summary":"WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.","evidence":"cve:CVE-2026-114570","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114570","aliases":["CVE-2026-114570"],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"}}],"affected":[{"vendor":"WordPress Foundation","product":"WordPress","versions":[{"status":"affected","version":"4.7.0","versionType":"semver","lessThanOrEqual":"4.7.33"},{"status":"affected","version":"4.8.0","versionType":"semver","lessThanOrEqual":"4.8.28"},{"status":"affected","version":"4.9.0","versionType":"semver","lessThanOrEqual":"4.9.29"},{"status":"affected","version":"5.0.0","versionType":"semver","lessThanOrEqual":"5.0.25"},{"status":"affected","version":"5.1.0","versionType":"semver","lessThanOrEqual":"5.1.22"},{"status":"affected","version":"5.2.0","versionType":"semver","lessThanOrEqual":"5.2.24"},{"status":"affected","version":"5.3.0","versionType":"semver","lessThanOrEqual":"5.3.21"},{"status":"affected","version":"5.4.0","versionType":"semver","lessThanOrEqual":"5.4.19"},{"status":"affected","version":"5.5.0","versionType":"semver","lessThanOrEqual":"5.5.18"},{"status":"affected","version":"5.6.0","versionType":"semver","lessThanOrEqual":"5.6.17"},{"status":"affected","version":"5.7.0","versionType":"semver","lessThanOrEqual":"5.7.15"},{"status":"affected","version":"5.8.0","versionType":"semver","lessThanOrEqual":"5.8.13"},{"status":"affected","version":"5.9.0","versionType":"semver","lessThanOrEqual":"5.9.13"},{"status":"affected","version":"6.0.0","versionType":"semver","lessThanOrEqual":"6.0.12"},{"status":"affected","version":"6.1.0","versionType":"semver","lessThanOrEqual":"6.1.10"},{"status":"affected","version":"6.2.0","versionType":"semver","lessThanOrEqual":"6.2.9"},{"status":"affected","version":"6.3.0","versionType":"semver","lessThanOrEqual":"6.3.8"},{"status":"affected","version":"6.4.0","versionType":"semver","lessThanOrEqual":"6.4.8"},{"status":"affected","version":"6.5.0","versionType":"semver","lessThanOrEqual":"6.5.8"},{"status":"affected","version":"6.6.0","versionType":"semver","lessThanOrEqual":"6.6.5"},{"status":"affected","version":"6.7.0","versionType":"semver","lessThanOrEqual":"6.7.5"},{"status":"affected","version":"6.8.0","versionType":"semver","lessThanOrEqual":"6.8.6"},{"status":"affected","version":"6.9.0","versionType":"semver","lessThanOrEqual":"6.9.5"},{"status":"affected","version":"7.0.0","versionType":"semver","lessThanOrEqual":"7.0.2"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T19:10:33.995Z","provider":"cve","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve","https://wordpress.org/news/2026/08/wordpress-7-0-3-release/","https://core.trac.wordpress.org/changeset/63061"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114570","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-22T13:33:19.865820Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T19:10:33.995Z"}}],"cna":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-10-22T05:29:48.488Z"}}},"related_cves":[{"value":"CVE-2026-114570","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:48ce7a1b-7970-4ba2-b10a-3351796d5867","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114570","advisory_id":"48ce7a1b-7970-4ba2-b10a-3351796d5867","event_types":["advisory"],"published_at":"2026-10-25T14:42:42.119675+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T05:29:48.488+00:00","detail_url":"/events/52312"}]}},{"id":34833,"cve_ids":["CVE-2026-93485"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","evidence":"cve:CVE-2026-93485","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93485","aliases":["CVE-2026-93485"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Automattic","product":"WordPress","versions":[{"status":"affected","version":"7.1"},{"status":"affected","changes":[{"at":"7.0.5","status":"unaffected"}],"version":"7.0","versionType":"custom","lessThanOrEqual":"7.0.4"},{"status":"affected","changes":[{"at":"6.9.8","status":"unaffected"}],"version":"6.9","versionType":"custom","lessThanOrEqual":"6.9.7"},{"status":"affected","changes":[{"at":"6.8.9","status":"unaffected"}],"version":"6.8","versionType":"custom","lessThanOrEqual":"6.8.8"},{"status":"affected","changes":[{"at":"6.7.8","status":"unaffected"}],"version":"6.7","versionType":"custom","lessThanOrEqual":"6.7.7"},{"status":"affected","changes":[{"at":"6.6.8","status":"unaffected"}],"version":"6.6","versionType":"custom","lessThanOrEqual":"6.6.7"},{"status":"affected","changes":[{"at":"6.5.11","status":"unaffected"}],"version":"6.5","versionType":"custom","lessThanOrEqual":"6.5.10"},{"status":"affected","changes":[{"at":"6.4.11","status":"unaffected"}],"version":"6.4","versionType":"custom","lessThanOrEqual":"6.4.10"},{"status":"affected","changes":[{"at":"6.3.11","status":"unaffected"}],"version":"6.3","versionType":"custom","lessThanOrEqual":"6.3.10"},{"status":"affected","changes":[{"at":"6.2.12","status":"unaffected"}],"version":"6.2","versionType":"custom","lessThanOrEqual":"6.2.11"},{"status":"affected","changes":[{"at":"6.1.13","status":"unaffected"}],"version":"6.1","versionType":"custom","lessThanOrEqual":"6.1.12"},{"status":"affected","changes":[{"at":"6.0.15","status":"unaffected"}],"version":"6.0","versionType":"custom","lessThanOrEqual":"6.0.14"},{"status":"affected","changes":[{"at":"5.9.17","status":"unaffected"}],"version":"5.9","versionType":"custom","lessThanOrEqual":"5.9.16"},{"status":"affected","changes":[{"at":"5.8.16","status":"unaffected"}],"version":"5.8","versionType":"custom","lessThanOrEqual":"5.8.15"},{"status":"affected","changes":[{"at":"5.7.18","status":"unaffected"}],"version":"5.7","versionType":"custom","lessThanOrEqual":"5.7.17"},{"status":"affected","changes":[{"at":"5.6.20","status":"unaffected"}],"version":"5.6","versionType":"custom","lessThanOrEqual":"5.6.19"},{"status":"affected","changes":[{"at":"5.5.21","status":"unaffected"}],"version":"5.5","versionType":"custom","lessThanOrEqual":"5.5.20"},{"status":"affected","changes":[{"at":"5.4.22","status":"unaffected"}],"version":"5.4","versionType":"custom","lessThanOrEqual":"5.4.21"},{"status":"affected","changes":[{"at":"5.3.24","status":"unaffected"}],"version":"5.3","versionType":"custom","lessThanOrEqual":"5.3.23"},{"status":"affected","changes":[{"at":"5.2.27","status":"unaffected"}],"version":"5.2","versionType":"custom","lessThanOrEqual":"5.2.26"},{"status":"affected","changes":[{"at":"5.1.25","status":"unaffected"}],"version":"5.1","versionType":"custom","lessThanOrEqual":"5.1.24"},{"status":"affected","changes":[{"at":"5.0.28","status":"unaffected"}],"version":"5.0","versionType":"custom","lessThanOrEqual":"5.0.27"},{"status":"affected","changes":[{"at":"4.9.32","status":"unaffected"}],"version":"4.9","versionType":"custom","lessThanOrEqual":"4.9.31"},{"status":"affected","changes":[{"at":"4.8.31","status":"unaffected"}],"version":"4.8","versionType":"custom","lessThanOrEqual":"4.8.30"},{"status":"affected","changes":[{"at":"4.7.36","status":"unaffected"}],"version":"4.7","versionType":"custom","lessThanOrEqual":"4.7.35"}],"packageName":"wordpress","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-17T08:25:50.124Z","provider":"cve","references":["https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93485","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-19T13:21:30.559066Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-19T14:21:52.478Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-17T08:25:50.124Z"}}},"related_cves":[{"value":"CVE-2026-93485","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:40dba7e2-9511-4b7a-b370-a6444a0e4a7c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93485","advisory_id":"40dba7e2-9511-4b7a-b370-a6444a0e4a7c","event_types":["advisory"],"published_at":"2026-10-25T09:24:39.296317+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T06:00:05.645+00:00","detail_url":"/advisories/advisory%3A40dba7e2-9511-4b7a-b370-a6444a0e4a7c","group":{"id":"advisory:40dba7e2-9511-4b7a-b370-a6444a0e4a7c","revision":1,"primary_event_id":34539,"change":"published","superseded_by":[],"changed":{"id":34539,"cve_ids":["CVE-2026-93485"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","evidence":"cve:CVE-2026-93485","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93485","aliases":["CVE-2026-93485"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Automattic","product":"WordPress","versions":[{"status":"affected","version":"7.1"},{"status":"affected","changes":[{"at":"7.0.5","status":"unaffected"}],"version":"7.0","versionType":"custom","lessThanOrEqual":"7.0.4"},{"status":"affected","changes":[{"at":"6.9.8","status":"unaffected"}],"version":"6.9","versionType":"custom","lessThanOrEqual":"6.9.7"},{"status":"affected","changes":[{"at":"6.8.9","status":"unaffected"}],"version":"6.8","versionType":"custom","lessThanOrEqual":"6.8.8"},{"status":"affected","changes":[{"at":"6.7.8","status":"unaffected"}],"version":"6.7","versionType":"custom","lessThanOrEqual":"6.7.7"},{"status":"affected","changes":[{"at":"6.6.8","status":"unaffected"}],"version":"6.6","versionType":"custom","lessThanOrEqual":"6.6.7"},{"status":"affected","changes":[{"at":"6.5.11","status":"unaffected"}],"version":"6.5","versionType":"custom","lessThanOrEqual":"6.5.10"},{"status":"affected","changes":[{"at":"6.4.11","status":"unaffected"}],"version":"6.4","versionType":"custom","lessThanOrEqual":"6.4.10"},{"status":"affected","changes":[{"at":"6.3.11","status":"unaffected"}],"version":"6.3","versionType":"custom","lessThanOrEqual":"6.3.10"},{"status":"affected","changes":[{"at":"6.2.12","status":"unaffected"}],"version":"6.2","versionType":"custom","lessThanOrEqual":"6.2.11"},{"status":"affected","changes":[{"at":"6.1.13","status":"unaffected"}],"version":"6.1","versionType":"custom","lessThanOrEqual":"6.1.12"},{"status":"affected","changes":[{"at":"6.0.15","status":"unaffected"}],"version":"6.0","versionType":"custom","lessThanOrEqual":"6.0.14"},{"status":"affected","changes":[{"at":"5.9.17","status":"unaffected"}],"version":"5.9","versionType":"custom","lessThanOrEqual":"5.9.16"},{"status":"affected","changes":[{"at":"5.8.16","status":"unaffected"}],"version":"5.8","versionType":"custom","lessThanOrEqual":"5.8.15"},{"status":"affected","changes":[{"at":"5.7.18","status":"unaffected"}],"version":"5.7","versionType":"custom","lessThanOrEqual":"5.7.17"},{"status":"affected","changes":[{"at":"5.6.20","status":"unaffected"}],"version":"5.6","versionType":"custom","lessThanOrEqual":"5.6.19"},{"status":"affected","changes":[{"at":"5.5.21","status":"unaffected"}],"version":"5.5","versionType":"custom","lessThanOrEqual":"5.5.20"},{"status":"affected","changes":[{"at":"5.4.22","status":"unaffected"}],"version":"5.4","versionType":"custom","lessThanOrEqual":"5.4.21"},{"status":"affected","changes":[{"at":"5.3.24","status":"unaffected"}],"version":"5.3","versionType":"custom","lessThanOrEqual":"5.3.23"},{"status":"affected","changes":[{"at":"5.2.27","status":"unaffected"}],"version":"5.2","versionType":"custom","lessThanOrEqual":"5.2.26"},{"status":"affected","changes":[{"at":"5.1.25","status":"unaffected"}],"version":"5.1","versionType":"custom","lessThanOrEqual":"5.1.24"},{"status":"affected","changes":[{"at":"5.0.28","status":"unaffected"}],"version":"5.0","versionType":"custom","lessThanOrEqual":"5.0.27"},{"status":"affected","changes":[{"at":"4.9.32","status":"unaffected"}],"version":"4.9","versionType":"custom","lessThanOrEqual":"4.9.31"},{"status":"affected","changes":[{"at":"4.8.31","status":"unaffected"}],"version":"4.8","versionType":"custom","lessThanOrEqual":"4.8.30"},{"status":"affected","changes":[{"at":"4.7.36","status":"unaffected"}],"version":"4.7","versionType":"custom","lessThanOrEqual":"4.7.35"}],"packageName":"wordpress","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-17T08:25:50.124Z","provider":"cve","references":["https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93485","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-19T13:21:30.559066Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-19T14:21:52.478Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-17T08:25:50.124Z"}}},"related_cves":[{"value":"CVE-2026-93485","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:40dba7e2-9511-4b7a-b370-a6444a0e4a7c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93485","advisory_id":"40dba7e2-9511-4b7a-b370-a6444a0e4a7c","event_types":["advisory"],"published_at":"2026-10-25T09:24:39.296317+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T06:00:05.645+00:00","detail_url":"/events/34539"},"members":[{"id":34539,"cve_ids":["CVE-2026-93485"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","evidence":"cve:CVE-2026-93485","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93485","aliases":["CVE-2026-93485"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Automattic","product":"WordPress","versions":[{"status":"affected","version":"7.1"},{"status":"affected","changes":[{"at":"7.0.5","status":"unaffected"}],"version":"7.0","versionType":"custom","lessThanOrEqual":"7.0.4"},{"status":"affected","changes":[{"at":"6.9.8","status":"unaffected"}],"version":"6.9","versionType":"custom","lessThanOrEqual":"6.9.7"},{"status":"affected","changes":[{"at":"6.8.9","status":"unaffected"}],"version":"6.8","versionType":"custom","lessThanOrEqual":"6.8.8"},{"status":"affected","changes":[{"at":"6.7.8","status":"unaffected"}],"version":"6.7","versionType":"custom","lessThanOrEqual":"6.7.7"},{"status":"affected","changes":[{"at":"6.6.8","status":"unaffected"}],"version":"6.6","versionType":"custom","lessThanOrEqual":"6.6.7"},{"status":"affected","changes":[{"at":"6.5.11","status":"unaffected"}],"version":"6.5","versionType":"custom","lessThanOrEqual":"6.5.10"},{"status":"affected","changes":[{"at":"6.4.11","status":"unaffected"}],"version":"6.4","versionType":"custom","lessThanOrEqual":"6.4.10"},{"status":"affected","changes":[{"at":"6.3.11","status":"unaffected"}],"version":"6.3","versionType":"custom","lessThanOrEqual":"6.3.10"},{"status":"affected","changes":[{"at":"6.2.12","status":"unaffected"}],"version":"6.2","versionType":"custom","lessThanOrEqual":"6.2.11"},{"status":"affected","changes":[{"at":"6.1.13","status":"unaffected"}],"version":"6.1","versionType":"custom","lessThanOrEqual":"6.1.12"},{"status":"affected","changes":[{"at":"6.0.15","status":"unaffected"}],"version":"6.0","versionType":"custom","lessThanOrEqual":"6.0.14"},{"status":"affected","changes":[{"at":"5.9.17","status":"unaffected"}],"version":"5.9","versionType":"custom","lessThanOrEqual":"5.9.16"},{"status":"affected","changes":[{"at":"5.8.16","status":"unaffected"}],"version":"5.8","versionType":"custom","lessThanOrEqual":"5.8.15"},{"status":"affected","changes":[{"at":"5.7.18","status":"unaffected"}],"version":"5.7","versionType":"custom","lessThanOrEqual":"5.7.17"},{"status":"affected","changes":[{"at":"5.6.20","status":"unaffected"}],"version":"5.6","versionType":"custom","lessThanOrEqual":"5.6.19"},{"status":"affected","changes":[{"at":"5.5.21","status":"unaffected"}],"version":"5.5","versionType":"custom","lessThanOrEqual":"5.5.20"},{"status":"affected","changes":[{"at":"5.4.22","status":"unaffected"}],"version":"5.4","versionType":"custom","lessThanOrEqual":"5.4.21"},{"status":"affected","changes":[{"at":"5.3.24","status":"unaffected"}],"version":"5.3","versionType":"custom","lessThanOrEqual":"5.3.23"},{"status":"affected","changes":[{"at":"5.2.27","status":"unaffected"}],"version":"5.2","versionType":"custom","lessThanOrEqual":"5.2.26"},{"status":"affected","changes":[{"at":"5.1.25","status":"unaffected"}],"version":"5.1","versionType":"custom","lessThanOrEqual":"5.1.24"},{"status":"affected","changes":[{"at":"5.0.28","status":"unaffected"}],"version":"5.0","versionType":"custom","lessThanOrEqual":"5.0.27"},{"status":"affected","changes":[{"at":"4.9.32","status":"unaffected"}],"version":"4.9","versionType":"custom","lessThanOrEqual":"4.9.31"},{"status":"affected","changes":[{"at":"4.8.31","status":"unaffected"}],"version":"4.8","versionType":"custom","lessThanOrEqual":"4.8.30"},{"status":"affected","changes":[{"at":"4.7.36","status":"unaffected"}],"version":"4.7","versionType":"custom","lessThanOrEqual":"4.7.35"}],"packageName":"wordpress","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-17T08:25:50.124Z","provider":"cve","references":["https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93485","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-19T13:21:30.559066Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-19T14:21:52.478Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-17T08:25:50.124Z"}}},"related_cves":[{"value":"CVE-2026-93485","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:40dba7e2-9511-4b7a-b370-a6444a0e4a7c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93485","advisory_id":"40dba7e2-9511-4b7a-b370-a6444a0e4a7c","event_types":["advisory"],"published_at":"2026-10-25T09:24:39.296317+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T06:00:05.645+00:00","detail_url":"/events/34539"}]}},{"id":12213,"cve_ids":["CVE-2026-63030"],"payload":{"kind":"advisory","title":"WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","summary":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","evidence":"cve:CVE-2026-63030","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-63030","aliases":["CVE-2026-63030"],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"affected":[{"vendor":"WordPress","product":"WordPress","versions":[{"status":"affected","version":"6.9.0","lessThan":"6.9.5","versionType":"semver"},{"status":"affected","version":"7.0.0","lessThan":"7.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-07T18:26:30.478Z","provider":"cve","references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q","https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63030","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T03:55:47.123838Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-07-21","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030","tags":["government-resource"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-436","description":"CWE-436 Interpretation Conflict"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:26:30.478Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-07-18T04:13:49.898Z"}}},"related_cves":[{"value":"CVE-2026-63030","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1979a16f-6972-4340-bbde-e3824c0f35dd","priority":{"reasons":["publisher_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-63030","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63030","advisory_id":"1979a16f-6972-4340-bbde-e3824c0f35dd","event_types":["advisory"],"published_at":"2026-10-25T00:02:48.762141+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-17T19:14:12.91+00:00","detail_url":"/advisories/advisory%3A1979a16f-6972-4340-bbde-e3824c0f35dd","group":{"id":"advisory:1979a16f-6972-4340-bbde-e3824c0f35dd","revision":1,"primary_event_id":12156,"change":"published","superseded_by":[],"changed":{"id":12156,"cve_ids":["CVE-2026-63030"],"payload":{"kind":"advisory","title":"WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","summary":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","evidence":"cve:CVE-2026-63030","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-63030","aliases":["CVE-2026-63030"],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"affected":[{"vendor":"WordPress","product":"WordPress","versions":[{"status":"affected","version":"6.9.0","lessThan":"6.9.5","versionType":"semver"},{"status":"affected","version":"7.0.0","lessThan":"7.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-07T18:26:30.478Z","provider":"cve","references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q","https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63030","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T03:55:47.123838Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-07-21","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030","tags":["government-resource"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-436","description":"CWE-436 Interpretation Conflict"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:26:30.478Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-07-18T04:13:49.898Z"}}},"related_cves":[{"value":"CVE-2026-63030","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1979a16f-6972-4340-bbde-e3824c0f35dd","priority":{"reasons":["publisher_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-63030","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63030","advisory_id":"1979a16f-6972-4340-bbde-e3824c0f35dd","event_types":["advisory"],"published_at":"2026-10-25T00:02:48.762141+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-17T19:14:12.91+00:00","detail_url":"/events/12156"},"members":[{"id":12156,"cve_ids":["CVE-2026-63030"],"payload":{"kind":"advisory","title":"WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","summary":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","evidence":"cve:CVE-2026-63030","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-63030","aliases":["CVE-2026-63030"],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"affected":[{"vendor":"WordPress","product":"WordPress","versions":[{"status":"affected","version":"6.9.0","lessThan":"6.9.5","versionType":"semver"},{"status":"affected","version":"7.0.0","lessThan":"7.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-07T18:26:30.478Z","provider":"cve","references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q","https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63030","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T03:55:47.123838Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-07-21","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030","tags":["government-resource"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-436","description":"CWE-436 Interpretation Conflict"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:26:30.478Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-07-18T04:13:49.898Z"}}},"related_cves":[{"value":"CVE-2026-63030","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1979a16f-6972-4340-bbde-e3824c0f35dd","priority":{"reasons":["publisher_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-63030","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63030","advisory_id":"1979a16f-6972-4340-bbde-e3824c0f35dd","event_types":["advisory"],"published_at":"2026-10-25T00:02:48.762141+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-17T19:14:12.91+00:00","detail_url":"/events/12156"}]}},{"id":12188,"cve_ids":["CVE-2026-60137"],"payload":{"kind":"advisory","title":"WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","summary":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","evidence":"cve:CVE-2026-60137","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-60137","aliases":["CVE-2026-60137"],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"affected":[{"vendor":"WordPress","product":"WordPress","versions":[{"status":"affected","version":"6.8.0","lessThan":"6.8.6","versionType":"semver"},{"status":"affected","version":"6.9.0","lessThan":"6.9.5","versionType":"semver"},{"status":"affected","version":"7.0.0","lessThan":"7.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-07T18:16:21.040Z","provider":"cve","references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf","https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-60137","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T03:55:47.898130Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-07-21","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137","tags":["government-resource"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:16:21.040Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-07-18T04:13:49.003Z"}}},"related_cves":[{"value":"CVE-2026-60137","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f7561c86-6e49-4695-abf1-d9b2226bef65","priority":{"reasons":["known_exploited"],"severity":"medium","linked_cves":[{"cve":"CVE-2026-60137","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60137","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-60137","advisory_id":"f7561c86-6e49-4695-abf1-d9b2226bef65","event_types":["advisory"],"published_at":"2026-10-25T00:02:31.838757+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-17T19:14:12.159+00:00","detail_url":"/advisories/advisory%3Af7561c86-6e49-4695-abf1-d9b2226bef65","group":{"id":"advisory:f7561c86-6e49-4695-abf1-d9b2226bef65","revision":1,"primary_event_id":12131,"change":"published","superseded_by":[],"changed":{"id":12131,"cve_ids":["CVE-2026-60137"],"payload":{"kind":"advisory","title":"WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","summary":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","evidence":"cve:CVE-2026-60137","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-60137","aliases":["CVE-2026-60137"],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"affected":[{"vendor":"WordPress","product":"WordPress","versions":[{"status":"affected","version":"6.8.0","lessThan":"6.8.6","versionType":"semver"},{"status":"affected","version":"6.9.0","lessThan":"6.9.5","versionType":"semver"},{"status":"affected","version":"7.0.0","lessThan":"7.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-07T18:16:21.040Z","provider":"cve","references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf","https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-60137","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T03:55:47.898130Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-07-21","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137","tags":["government-resource"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:16:21.040Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-07-18T04:13:49.003Z"}}},"related_cves":[{"value":"CVE-2026-60137","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f7561c86-6e49-4695-abf1-d9b2226bef65","priority":{"reasons":["known_exploited"],"severity":"medium","linked_cves":[{"cve":"CVE-2026-60137","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60137","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-60137","advisory_id":"f7561c86-6e49-4695-abf1-d9b2226bef65","event_types":["advisory"],"published_at":"2026-10-25T00:02:31.838757+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-17T19:14:12.159+00:00","detail_url":"/events/12131"},"members":[{"id":12131,"cve_ids":["CVE-2026-60137"],"payload":{"kind":"advisory","title":"WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","summary":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","evidence":"cve:CVE-2026-60137","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-60137","aliases":["CVE-2026-60137"],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"affected":[{"vendor":"WordPress","product":"WordPress","versions":[{"status":"affected","version":"6.8.0","lessThan":"6.8.6","versionType":"semver"},{"status":"affected","version":"6.9.0","lessThan":"6.9.5","versionType":"semver"},{"status":"affected","version":"7.0.0","lessThan":"7.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-07T18:16:21.040Z","provider":"cve","references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf","https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-60137","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T03:55:47.898130Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-07-21","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137","tags":["government-resource"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:16:21.040Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-07-18T04:13:49.003Z"}}},"related_cves":[{"value":"CVE-2026-60137","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f7561c86-6e49-4695-abf1-d9b2226bef65","priority":{"reasons":["known_exploited"],"severity":"medium","linked_cves":[{"cve":"CVE-2026-60137","metrics":[],"products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60137","relationship":"advisory","known_exploited":true,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":true,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-60137","advisory_id":"f7561c86-6e49-4695-abf1-d9b2226bef65","event_types":["advisory"],"published_at":"2026-10-25T00:02:31.838757+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-17T19:14:12.159+00:00","detail_url":"/events/12131"}]}},{"id":9624,"cve_ids":["CVE-2026-66666"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.","evidence":"cve:CVE-2026-66666","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-66666","aliases":["CVE-2026-66666"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Automattic","product":"WordPress","versions":[{"status":"affected","changes":[{"at":"7.1.3","status":"unaffected"}],"version":"7.1","versionType":"custom","lessThanOrEqual":"7.1.2"},{"status":"affected","changes":[{"at":"7.0.7","status":"unaffected"}],"version":"7.0","versionType":"custom","lessThanOrEqual":"7.0.6"},{"status":"affected","changes":[{"at":"6.9.10","status":"unaffected"}],"version":"6.9","versionType":"custom","lessThanOrEqual":"6.9.9"},{"status":"affected","changes":[{"at":"6.8.11","status":"unaffected"}],"version":"6.8","versionType":"custom","lessThanOrEqual":"6.8.10"},{"status":"affected","changes":[{"at":"6.7.10","status":"unaffected"}],"version":"6.7","versionType":"custom","lessThanOrEqual":"6.7.9"},{"status":"affected","changes":[{"at":"6.6.10","status":"unaffected"}],"version":"6.6","versionType":"custom","lessThanOrEqual":"6.6.9"}],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:05:54.337Z","provider":"cve","references":["https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve","https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/","https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-66666","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T18:21:14.868038Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T18:21:39.557Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-06T20:05:54.337Z"}}},"related_cves":[{"value":"CVE-2026-66666","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebaff33c-7d3b-47c8-b552-d834cb76a924","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-66666","advisory_id":"ebaff33c-7d3b-47c8-b552-d834cb76a924","event_types":["advisory"],"published_at":"2026-10-24T23:20:18.106537+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T17:48:37.371+00:00","detail_url":"/advisories/advisory%3Aebaff33c-7d3b-47c8-b552-d834cb76a924","group":{"id":"advisory:ebaff33c-7d3b-47c8-b552-d834cb76a924","revision":1,"primary_event_id":9599,"change":"published","superseded_by":[],"changed":{"id":9599,"cve_ids":["CVE-2026-66666"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.","evidence":"cve:CVE-2026-66666","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-66666","aliases":["CVE-2026-66666"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Automattic","product":"WordPress","versions":[{"status":"affected","changes":[{"at":"7.1.3","status":"unaffected"}],"version":"7.1","versionType":"custom","lessThanOrEqual":"7.1.2"},{"status":"affected","changes":[{"at":"7.0.7","status":"unaffected"}],"version":"7.0","versionType":"custom","lessThanOrEqual":"7.0.6"},{"status":"affected","changes":[{"at":"6.9.10","status":"unaffected"}],"version":"6.9","versionType":"custom","lessThanOrEqual":"6.9.9"},{"status":"affected","changes":[{"at":"6.8.11","status":"unaffected"}],"version":"6.8","versionType":"custom","lessThanOrEqual":"6.8.10"},{"status":"affected","changes":[{"at":"6.7.10","status":"unaffected"}],"version":"6.7","versionType":"custom","lessThanOrEqual":"6.7.9"},{"status":"affected","changes":[{"at":"6.6.10","status":"unaffected"}],"version":"6.6","versionType":"custom","lessThanOrEqual":"6.6.9"}],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:05:54.337Z","provider":"cve","references":["https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve","https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/","https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-66666","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T18:21:14.868038Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T18:21:39.557Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-06T20:05:54.337Z"}}},"related_cves":[{"value":"CVE-2026-66666","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebaff33c-7d3b-47c8-b552-d834cb76a924","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-66666","advisory_id":"ebaff33c-7d3b-47c8-b552-d834cb76a924","event_types":["advisory"],"published_at":"2026-10-24T23:20:18.106537+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T17:48:37.371+00:00","detail_url":"/events/9599"},"members":[{"id":9599,"cve_ids":["CVE-2026-66666"],"payload":{"kind":"advisory","title":"WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.","evidence":"cve:CVE-2026-66666","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-66666","aliases":["CVE-2026-66666"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Automattic","product":"WordPress","versions":[{"status":"affected","changes":[{"at":"7.1.3","status":"unaffected"}],"version":"7.1","versionType":"custom","lessThanOrEqual":"7.1.2"},{"status":"affected","changes":[{"at":"7.0.7","status":"unaffected"}],"version":"7.0","versionType":"custom","lessThanOrEqual":"7.0.6"},{"status":"affected","changes":[{"at":"6.9.10","status":"unaffected"}],"version":"6.9","versionType":"custom","lessThanOrEqual":"6.9.9"},{"status":"affected","changes":[{"at":"6.8.11","status":"unaffected"}],"version":"6.8","versionType":"custom","lessThanOrEqual":"6.8.10"},{"status":"affected","changes":[{"at":"6.7.10","status":"unaffected"}],"version":"6.7","versionType":"custom","lessThanOrEqual":"6.7.9"},{"status":"affected","changes":[{"at":"6.6.10","status":"unaffected"}],"version":"6.6","versionType":"custom","lessThanOrEqual":"6.6.9"}],"defaultStatus":"unaffected"}],"modified":"2026-10-06T20:05:54.337Z","provider":"cve","references":["https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve","https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/","https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-66666","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-06T18:21:14.868038Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T18:21:39.557Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-06T20:05:54.337Z"}}},"related_cves":[{"value":"CVE-2026-66666","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ebaff33c-7d3b-47c8-b552-d834cb76a924","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-66666","advisory_id":"ebaff33c-7d3b-47c8-b552-d834cb76a924","event_types":["advisory"],"published_at":"2026-10-24T23:20:18.106537+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-06T17:48:37.371+00:00","detail_url":"/events/9599"}]}},{"id":8574,"cve_ids":["CVE-2023-39999"],"payload":{"kind":"advisory","title":"WordPress < 6.3.2 is vulnerable to Broken Access Control","summary":"Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.","evidence":"cve:CVE-2023-39999","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2023-39999","aliases":["CVE-2023-39999"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"WordPress.org","product":"WordPress","versions":[{"status":"affected","changes":[{"at":"6.3.2","status":"unaffected"}],"version":"6.3","versionType":"custom","lessThanOrEqual":"6.3.1"},{"status":"affected","changes":[{"at":"6.2.3","status":"unaffected"}],"version":"6.2","versionType":"custom","lessThanOrEqual":"6.2.2"},{"status":"affected","changes":[{"at":"6.1.4","status":"unaffected"}],"version":"6.1","versionType":"custom","lessThanOrEqual":"6.1.3"},{"status":"affected","changes":[{"at":"6.0.6","status":"unaffected"}],"version":"6.0","versionType":"custom","lessThanOrEqual":"6.0.5"},{"status":"affected","changes":[{"at":"5.9.8","status":"unaffected"}],"version":"5.9","versionType":"custom","lessThanOrEqual":"5.9.7"},{"status":"affected","changes":[{"at":"5.8.8","status":"unaffected"}],"version":"5.8","versionType":"custom","lessThanOrEqual":"5.8.7"},{"status":"affected","changes":[{"at":"5.7.10","status":"unaffected"}],"version":"5.7","versionType":"custom","lessThanOrEqual":"5.7.9"},{"status":"affected","changes":[{"at":"5.6.12","status":"unaffected"}],"version":"5.6","versionType":"custom","lessThanOrEqual":"5.6.11"},{"status":"affected","changes":[{"at":"5.5.13","status":"unaffected"}],"version":"5.5","versionType":"custom","lessThanOrEqual":"5.5.12"},{"status":"affected","changes":[{"at":"5.4.14","status":"unaffected"}],"version":"5.4","versionType":"custom","lessThanOrEqual":"5.4.13"},{"status":"affected","changes":[{"at":"5.3.16","status":"unaffected"}],"version":"5.3","versionType":"custom","lessThanOrEqual":"5.3.15"},{"status":"affected","changes":[{"at":"5.2.19","status":"unaffected"}],"version":"5.2","versionType":"custom","lessThanOrEqual":"5.2.18"},{"status":"affected","changes":[{"at":"5.1.17","status":"unaffected"}],"version":"5.1","versionType":"custom","lessThanOrEqual":"5.1.16"},{"status":"affected","changes":[{"at":"5.0.20","status":"unaffected"}],"version":"5.0","versionType":"custom","lessThanOrEqual":"5.0.19"},{"status":"affected","changes":[{"at":"4.9.24","status":"unaffected"}],"version":"4.9","versionType":"custom","lessThanOrEqual":"4.9.23"},{"status":"affected","changes":[{"at":"4.8.23","status":"unaffected"}],"version":"4.8","versionType":"custom","lessThanOrEqual":"4.8.22"},{"status":"affected","changes":[{"at":"4.7.27","status":"unaffected"}],"version":"4.7","versionType":"custom","lessThanOrEqual":"4.7.26"},{"status":"affected","changes":[{"at":"4.6.27","status":"unaffected"}],"version":"4.6","versionType":"custom","lessThanOrEqual":"4.6.26"},{"status":"affected","changes":[{"at":"4.5.30","status":"unaffected"}],"version":"4.5","versionType":"custom","lessThanOrEqual":"4.5.29"},{"status":"affected","changes":[{"at":"4.4.31","status":"unaffected"}],"version":"4.4","versionType":"custom","lessThanOrEqual":"4.4.30"},{"status":"affected","changes":[{"at":"4.3.32","status":"unaffected"}],"version":"4.3","versionType":"custom","lessThanOrEqual":"4.3.31"},{"status":"affected","changes":[{"at":"4.2.36","status":"unaffected"}],"version":"4.2","versionType":"custom","lessThanOrEqual":"4.2.35"},{"status":"affected","changes":[{"at":"4.1.39","status":"unaffected"}],"version":"4.1","versionType":"custom","lessThanOrEqual":"4.1.38"}],"defaultStatus":"unaffected"}],"modified":"2026-10-05T12:20:21.928Z","provider":"cve","references":["https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/","https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","tags":["third-party-advisory","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T18:18:10.210Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-05T12:20:21.928Z"}}},"related_cves":[{"value":"CVE-2023-39999","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:08e1268f-bcc8-4131-a98d-1a867d6a5b75","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-39999","advisory_id":"08e1268f-bcc8-4131-a98d-1a867d6a5b75","event_types":["advisory"],"published_at":"2026-10-24T23:03:02.801333+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2023-10-13T11:31:16.977+00:00","detail_url":"/advisories/advisory%3A08e1268f-bcc8-4131-a98d-1a867d6a5b75","group":{"id":"advisory:08e1268f-bcc8-4131-a98d-1a867d6a5b75","revision":1,"primary_event_id":8564,"change":"published","superseded_by":[],"changed":{"id":8564,"cve_ids":["CVE-2023-39999"],"payload":{"kind":"advisory","title":"WordPress < 6.3.2 is vulnerable to Broken Access Control","summary":"Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.","evidence":"cve:CVE-2023-39999","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2023-39999","aliases":["CVE-2023-39999"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"WordPress.org","product":"WordPress","versions":[{"status":"affected","changes":[{"at":"6.3.2","status":"unaffected"}],"version":"6.3","versionType":"custom","lessThanOrEqual":"6.3.1"},{"status":"affected","changes":[{"at":"6.2.3","status":"unaffected"}],"version":"6.2","versionType":"custom","lessThanOrEqual":"6.2.2"},{"status":"affected","changes":[{"at":"6.1.4","status":"unaffected"}],"version":"6.1","versionType":"custom","lessThanOrEqual":"6.1.3"},{"status":"affected","changes":[{"at":"6.0.6","status":"unaffected"}],"version":"6.0","versionType":"custom","lessThanOrEqual":"6.0.5"},{"status":"affected","changes":[{"at":"5.9.8","status":"unaffected"}],"version":"5.9","versionType":"custom","lessThanOrEqual":"5.9.7"},{"status":"affected","changes":[{"at":"5.8.8","status":"unaffected"}],"version":"5.8","versionType":"custom","lessThanOrEqual":"5.8.7"},{"status":"affected","changes":[{"at":"5.7.10","status":"unaffected"}],"version":"5.7","versionType":"custom","lessThanOrEqual":"5.7.9"},{"status":"affected","changes":[{"at":"5.6.12","status":"unaffected"}],"version":"5.6","versionType":"custom","lessThanOrEqual":"5.6.11"},{"status":"affected","changes":[{"at":"5.5.13","status":"unaffected"}],"version":"5.5","versionType":"custom","lessThanOrEqual":"5.5.12"},{"status":"affected","changes":[{"at":"5.4.14","status":"unaffected"}],"version":"5.4","versionType":"custom","lessThanOrEqual":"5.4.13"},{"status":"affected","changes":[{"at":"5.3.16","status":"unaffected"}],"version":"5.3","versionType":"custom","lessThanOrEqual":"5.3.15"},{"status":"affected","changes":[{"at":"5.2.19","status":"unaffected"}],"version":"5.2","versionType":"custom","lessThanOrEqual":"5.2.18"},{"status":"affected","changes":[{"at":"5.1.17","status":"unaffected"}],"version":"5.1","versionType":"custom","lessThanOrEqual":"5.1.16"},{"status":"affected","changes":[{"at":"5.0.20","status":"unaffected"}],"version":"5.0","versionType":"custom","lessThanOrEqual":"5.0.19"},{"status":"affected","changes":[{"at":"4.9.24","status":"unaffected"}],"version":"4.9","versionType":"custom","lessThanOrEqual":"4.9.23"},{"status":"affected","changes":[{"at":"4.8.23","status":"unaffected"}],"version":"4.8","versionType":"custom","lessThanOrEqual":"4.8.22"},{"status":"affected","changes":[{"at":"4.7.27","status":"unaffected"}],"version":"4.7","versionType":"custom","lessThanOrEqual":"4.7.26"},{"status":"affected","changes":[{"at":"4.6.27","status":"unaffected"}],"version":"4.6","versionType":"custom","lessThanOrEqual":"4.6.26"},{"status":"affected","changes":[{"at":"4.5.30","status":"unaffected"}],"version":"4.5","versionType":"custom","lessThanOrEqual":"4.5.29"},{"status":"affected","changes":[{"at":"4.4.31","status":"unaffected"}],"version":"4.4","versionType":"custom","lessThanOrEqual":"4.4.30"},{"status":"affected","changes":[{"at":"4.3.32","status":"unaffected"}],"version":"4.3","versionType":"custom","lessThanOrEqual":"4.3.31"},{"status":"affected","changes":[{"at":"4.2.36","status":"unaffected"}],"version":"4.2","versionType":"custom","lessThanOrEqual":"4.2.35"},{"status":"affected","changes":[{"at":"4.1.39","status":"unaffected"}],"version":"4.1","versionType":"custom","lessThanOrEqual":"4.1.38"}],"defaultStatus":"unaffected"}],"modified":"2026-10-05T12:20:21.928Z","provider":"cve","references":["https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/","https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","tags":["third-party-advisory","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T18:18:10.210Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-05T12:20:21.928Z"}}},"related_cves":[{"value":"CVE-2023-39999","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:08e1268f-bcc8-4131-a98d-1a867d6a5b75","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-39999","advisory_id":"08e1268f-bcc8-4131-a98d-1a867d6a5b75","event_types":["advisory"],"published_at":"2026-10-24T23:03:02.801333+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2023-10-13T11:31:16.977+00:00","detail_url":"/events/8564"},"members":[{"id":8564,"cve_ids":["CVE-2023-39999"],"payload":{"kind":"advisory","title":"WordPress < 6.3.2 is vulnerable to Broken Access Control","summary":"Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.","evidence":"cve:CVE-2023-39999","products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2023-39999","aliases":["CVE-2023-39999"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"WordPress.org","product":"WordPress","versions":[{"status":"affected","changes":[{"at":"6.3.2","status":"unaffected"}],"version":"6.3","versionType":"custom","lessThanOrEqual":"6.3.1"},{"status":"affected","changes":[{"at":"6.2.3","status":"unaffected"}],"version":"6.2","versionType":"custom","lessThanOrEqual":"6.2.2"},{"status":"affected","changes":[{"at":"6.1.4","status":"unaffected"}],"version":"6.1","versionType":"custom","lessThanOrEqual":"6.1.3"},{"status":"affected","changes":[{"at":"6.0.6","status":"unaffected"}],"version":"6.0","versionType":"custom","lessThanOrEqual":"6.0.5"},{"status":"affected","changes":[{"at":"5.9.8","status":"unaffected"}],"version":"5.9","versionType":"custom","lessThanOrEqual":"5.9.7"},{"status":"affected","changes":[{"at":"5.8.8","status":"unaffected"}],"version":"5.8","versionType":"custom","lessThanOrEqual":"5.8.7"},{"status":"affected","changes":[{"at":"5.7.10","status":"unaffected"}],"version":"5.7","versionType":"custom","lessThanOrEqual":"5.7.9"},{"status":"affected","changes":[{"at":"5.6.12","status":"unaffected"}],"version":"5.6","versionType":"custom","lessThanOrEqual":"5.6.11"},{"status":"affected","changes":[{"at":"5.5.13","status":"unaffected"}],"version":"5.5","versionType":"custom","lessThanOrEqual":"5.5.12"},{"status":"affected","changes":[{"at":"5.4.14","status":"unaffected"}],"version":"5.4","versionType":"custom","lessThanOrEqual":"5.4.13"},{"status":"affected","changes":[{"at":"5.3.16","status":"unaffected"}],"version":"5.3","versionType":"custom","lessThanOrEqual":"5.3.15"},{"status":"affected","changes":[{"at":"5.2.19","status":"unaffected"}],"version":"5.2","versionType":"custom","lessThanOrEqual":"5.2.18"},{"status":"affected","changes":[{"at":"5.1.17","status":"unaffected"}],"version":"5.1","versionType":"custom","lessThanOrEqual":"5.1.16"},{"status":"affected","changes":[{"at":"5.0.20","status":"unaffected"}],"version":"5.0","versionType":"custom","lessThanOrEqual":"5.0.19"},{"status":"affected","changes":[{"at":"4.9.24","status":"unaffected"}],"version":"4.9","versionType":"custom","lessThanOrEqual":"4.9.23"},{"status":"affected","changes":[{"at":"4.8.23","status":"unaffected"}],"version":"4.8","versionType":"custom","lessThanOrEqual":"4.8.22"},{"status":"affected","changes":[{"at":"4.7.27","status":"unaffected"}],"version":"4.7","versionType":"custom","lessThanOrEqual":"4.7.26"},{"status":"affected","changes":[{"at":"4.6.27","status":"unaffected"}],"version":"4.6","versionType":"custom","lessThanOrEqual":"4.6.26"},{"status":"affected","changes":[{"at":"4.5.30","status":"unaffected"}],"version":"4.5","versionType":"custom","lessThanOrEqual":"4.5.29"},{"status":"affected","changes":[{"at":"4.4.31","status":"unaffected"}],"version":"4.4","versionType":"custom","lessThanOrEqual":"4.4.30"},{"status":"affected","changes":[{"at":"4.3.32","status":"unaffected"}],"version":"4.3","versionType":"custom","lessThanOrEqual":"4.3.31"},{"status":"affected","changes":[{"at":"4.2.36","status":"unaffected"}],"version":"4.2","versionType":"custom","lessThanOrEqual":"4.2.35"},{"status":"affected","changes":[{"at":"4.1.39","status":"unaffected"}],"version":"4.1","versionType":"custom","lessThanOrEqual":"4.1.38"}],"defaultStatus":"unaffected"}],"modified":"2026-10-05T12:20:21.928Z","provider":"cve","references":["https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/","https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","tags":["third-party-advisory","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T18:18:10.210Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-05T12:20:21.928Z"}}},"related_cves":[{"value":"CVE-2023-39999","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:08e1268f-bcc8-4131-a98d-1a867d6a5b75","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-39999","advisory_id":"08e1268f-bcc8-4131-a98d-1a867d6a5b75","event_types":["advisory"],"published_at":"2026-10-24T23:03:02.801333+00:00","technologies":["core-cve","wordpress"],"context_update":false,"extraction_method":"structured","source_published_at":"2023-10-13T11:31:16.977+00:00","detail_url":"/events/8564"}]}}],"next_after":60364,"next_before":8574}