Description

WordPress processes shortcodes in user-generated content on block themes. This could allow an attacker to execute shortcodes via submitting comments or other content, allowing them to exploit vulnerabilities that typically require higher permissions. WordPress versions 6.0.x ranging from 6.0 and up to (and including) 6.0.4 are vulnerable.

Remediation

Update to WordPress version 6.0.5 or latest

References

https://wordpress.org/news/2023/05/wordpress-6-2-2-security-release/

Related Vulnerabilities

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-44309)

Liferay Portal Uncontrolled Resource Consumption Vulnerability (CVE-2025-62260)

PHP NULL Pointer Dereference Vulnerability (CVE-2025-6491)

WordPress Plugin NotificationX-WooCommerce Sales Notification Popup, Custom & Live Sales Notification, FOMO, Social Proof, Announcement Banner & Sticky Notification Bar SQL Injection (2.3.11)

MySQL CVE-2024-21134 Vulnerability (CVE-2024-21134)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Code Execution CWE-862