p PatchFirst

CVE-2026-114570

CVE-2026-114570 · WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

CVSS 4.9 · Moyenne · EPSS 0,2%

Publication
Mise à jour

Produits et versions concernés

  • wordpress

    Versions du logiciel
    • ≥ 4.7.0, ≤ 4.7.33: Concernée (semver)
    • ≥ 4.8.0, ≤ 4.8.28: Concernée (semver)
    • ≥ 4.9.0, ≤ 4.9.29: Concernée (semver)
    • ≥ 5.0.0, ≤ 5.0.25: Concernée (semver)
    • ≥ 5.1.0, ≤ 5.1.22: Concernée (semver)
    • ≥ 5.2.0, ≤ 5.2.24: Concernée (semver)
    • ≥ 5.3.0, ≤ 5.3.21: Concernée (semver)
    • ≥ 5.4.0, ≤ 5.4.19: Concernée (semver)
    • ≥ 5.5.0, ≤ 5.5.18: Concernée (semver)
    • ≥ 5.6.0, ≤ 5.6.17: Concernée (semver)
    • ≥ 5.7.0, ≤ 5.7.15: Concernée (semver)
    • ≥ 5.8.0, ≤ 5.8.13: Concernée (semver)
    • ≥ 5.9.0, ≤ 5.9.13: Concernée (semver)
    • ≥ 6.0.0, ≤ 6.0.12: Concernée (semver)
    • ≥ 6.1.0, ≤ 6.1.10: Concernée (semver)
    • ≥ 6.2.0, ≤ 6.2.9: Concernée (semver)
    • ≥ 6.3.0, ≤ 6.3.8: Concernée (semver)
    • ≥ 6.4.0, ≤ 6.4.8: Concernée (semver)
    • ≥ 6.5.0, ≤ 6.5.8: Concernée (semver)
    • ≥ 6.6.0, ≤ 6.6.5: Concernée (semver)
    • ≥ 6.7.0, ≤ 6.7.5: Concernée (semver)
    • ≥ 6.8.0, ≤ 6.8.6: Concernée (semver)
    • ≥ 6.9.0, ≤ 6.9.5: Concernée (semver)
    • ≥ 7.0.0, ≤ 7.0.2: Concernée (semver)

    Aucun correctif publié

Sources originales

Vérifiez votre serveur →