4.9
Medium
CVE-2026-114570 WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2…
Description
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress 7.0 | 7.0.0 → 7.0.2 | No fix stated |
| WordPress 6.9 | 6.9.0 → 6.9.5 | No fix stated |
| WordPress 6.8 | 6.8.0 → 6.8.6 | No fix stated |
| WordPress 6.7 | 6.7.0 → 6.7.5 | No fix stated |
| WordPress 6.6 | 6.6.0 → 6.6.5 | No fix stated |
| WordPress 6.5 | 6.5.0 → 6.5.8 | No fix stated |
| WordPress 6.4 | 6.4.0 → 6.4.8 | No fix stated |
| WordPress 6.3 | 6.3.0 → 6.3.8 | No fix stated |
| WordPress 6.2 | 6.2.0 → 6.2.9 | No fix stated |
Show the 15 other branches Hide the 15 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress 6.1 | 6.1.0 → 6.1.10 | No fix stated |
| WordPress 6.0 | 6.0.0 → 6.0.12 | No fix stated |
| WordPress 5.9 | 5.9.0 → 5.9.13 | No fix stated |
| WordPress 5.8 | 5.8.0 → 5.8.13 | No fix stated |
| WordPress 5.7 | 5.7.0 → 5.7.15 | No fix stated |
| WordPress 5.6 | 5.6.0 → 5.6.17 | No fix stated |
| WordPress 5.5 | 5.5.0 → 5.5.18 | No fix stated |
| WordPress 5.4 | 5.4.0 → 5.4.19 | No fix stated |
| WordPress 5.3 | 5.3.0 → 5.3.21 | No fix stated |
| WordPress 5.2 | 5.2.0 → 5.2.24 | No fix stated |
| WordPress 5.1 | 5.1.0 → 5.1.22 | No fix stated |
| WordPress 5.0 | 5.0.0 → 5.0.25 | No fix stated |
| WordPress 4.9 | 4.9.0 → 4.9.29 | No fix stated |
| WordPress 4.8 | 4.8.0 → 4.8.28 | No fix stated |
| WordPress 4.7 | 4.7.0 → 4.7.33 | No fix stated |
References
- www.wordfence.com www.wordfence.com
- wordpress.org wordpress.org
- core.trac.wordpress.org core.trac.wordpress.org
Timeline
- Published
- Last modified
Other CVEs of WordPress
The 8 CVEs of WordPress →
CVE-2026-119977
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
8.1
High
CVE-2026-3906
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1
4.3
Medium
CVE-2022-4973
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be…
4.9
Medium
CVE-2024-6307
WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to…
6.4
Medium