p PatchFirst

CVE-2026-114570

CVE-2026-114570 · WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

CVSS 4.9 · Medium · EPSS 0.2%

Published
Updated

Affected products and versions

  • wordpress

    Versions
    • ≥ 4.7.0, ≤ 4.7.33: Affected (semver)
    • ≥ 4.8.0, ≤ 4.8.28: Affected (semver)
    • ≥ 4.9.0, ≤ 4.9.29: Affected (semver)
    • ≥ 5.0.0, ≤ 5.0.25: Affected (semver)
    • ≥ 5.1.0, ≤ 5.1.22: Affected (semver)
    • ≥ 5.2.0, ≤ 5.2.24: Affected (semver)
    • ≥ 5.3.0, ≤ 5.3.21: Affected (semver)
    • ≥ 5.4.0, ≤ 5.4.19: Affected (semver)
    • ≥ 5.5.0, ≤ 5.5.18: Affected (semver)
    • ≥ 5.6.0, ≤ 5.6.17: Affected (semver)
    • ≥ 5.7.0, ≤ 5.7.15: Affected (semver)
    • ≥ 5.8.0, ≤ 5.8.13: Affected (semver)
    • ≥ 5.9.0, ≤ 5.9.13: Affected (semver)
    • ≥ 6.0.0, ≤ 6.0.12: Affected (semver)
    • ≥ 6.1.0, ≤ 6.1.10: Affected (semver)
    • ≥ 6.2.0, ≤ 6.2.9: Affected (semver)
    • ≥ 6.3.0, ≤ 6.3.8: Affected (semver)
    • ≥ 6.4.0, ≤ 6.4.8: Affected (semver)
    • ≥ 6.5.0, ≤ 6.5.8: Affected (semver)
    • ≥ 6.6.0, ≤ 6.6.5: Affected (semver)
    • ≥ 6.7.0, ≤ 6.7.5: Affected (semver)
    • ≥ 6.8.0, ≤ 6.8.6: Affected (semver)
    • ≥ 6.9.0, ≤ 6.9.5: Affected (semver)
    • ≥ 7.0.0, ≤ 7.0.2: Affected (semver)

    No fix published

Original sources

Check your server →