Your privacy choices

We use cookies to see how the site is used and, with Google and Meta, to measure our ads. Nothing is set until you choose. You can change your choice at any time under Cookie settings.

Privacy Policy

We use cookies to see how the site is used and, with Google and Meta, to measure our ads. You can change your choice at any time under Your Privacy Choices.

Your privacy choices

Choose which cookies we may use. Your choice applies on every page and lasts 12 months.

Your opt-out preference signal has been honored. Advertising stays off while your browser sends it.

NecessaryKeeps the site working: your privacy choice here, the language you are reading in, the documentation search, and Cloudflare's protection of the site.
Always on
Google Analytics and Cloudflare Web Analytics, and WooCommerce's own record of the page your visit started on: which pages are read, how the site is used, and which of them lead to an order.
Google Ads and the Meta pixel: measuring and improving our ads, including on other sites.
ThriveDesk, which runs the live chat on our support page. It is run by another company and stores an identifier in your browser.
Privacy Policy
Security & Updates

WordPress 6.0.3 Security Update – 16 Vulnerabilities That Must Be Fixed

By Bright Plugins·December 29, 2025·1 min read
WordPress 6.0.3 Security Update – 16 Vulnerabilities That Must Be Fixed

The WordPress 6.0.3 Security Update contains patches for many vulnerabilities, most of which are low in severity or require a highly privileged user account or additional vulnerable code to exploit.

We want to share these vulnerabilities so you know them and take action to avoid a potentially hacked site.

1. Authenticated (Contributor+) Stored Cross-Site Scripting via RSS Widget/Block
Affected Versions: WordPress Core < 6.0.3 & Gutenberg < 14.3.1
Researcher:  N/A
CVE ID: Pending
CVSS Score: 6.4(Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Fully Patched Version: 6.0.3
Changeset: https://core.trac.wordpress.org/changeset/54543

A contributor-level attacker could create a page on a site they controlled that returned an error code and a malicious script in the Content-Type response header. 

2. Authenticated Stored Cross-Site Scripting via Search Block
Affected Versions: WordPress Core < 6.0.3 & Gutenberg < 14.3.1
Researcher: Alex Concha
CVE ID: Pending
CVSS Score: 6.4(Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Fully Patched Version: 6.0.3
Changeset: https://core.trac.wordpress.org/changeset/54543

It is possible for users that can edit posts to inject malicious JavaScript via the Search Block’s Text color and Background color attributes. 

Description: Authenticated Stored Cross-Site Scripting via Featured Image Block
Affected Versions: WordPress Core < 6.0.3 & Gutenberg < 14.3.1
Researcher: N/A
CVE ID: Pending
CVSS Score: 6.4(Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Fully Patched Version: 6.0.3
Changeset: https://core.trac.wordpress.org/changeset/54543

Keep reading

Subscribe to our newsletter

WooCommerce tips, plugin updates, and release notes. No spam.