CVE-2026-114570
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
Medium 4.9
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
Assigner
Wordfence
Wordfence
Published
2026-10-22
2026-10-22
Updated
2026-10-22
2026-10-22
Reserved
2026-10-21
2026-10-21
Scores
| Source | CVSS | Score | Severity | Vector |
|---|---|---|---|---|
| Wordfence | 3.1 | 4.9 | Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N |
Weaknesses
Affected
| Vendor | Product | Versions |
|---|---|---|
| WordPress Foundation | WordPress | 4.7.0 to <= 4.7.33 (affected) 4.8.0 to <= 4.8.28 (affected) 4.9.0 to <= 4.9.29 (affected) 5.0.0 to <= 5.0.25 (affected) 5.1.0 to <= 5.1.22 (affected) 5.2.0 to <= 5.2.24 (affected) 5.3.0 to <= 5.3.21 (affected) 5.4.0 to <= 5.4.19 (affected) 5.5.0 to <= 5.5.18 (affected) 5.6.0 to <= 5.6.17 (affected) 5.7.0 to <= 5.7.15 (affected) 5.8.0 to <= 5.8.13 (affected) +12 more in the JSON others: unaffected |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve
- https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
- https://core.trac.wordpress.org/changeset/63061
Full CVE JSON record (5.2)
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "WordPress Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.33",
"status": "affected",
"version": "4.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.8.28",
"status": "affected",
"version": "4.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.29",
"status": "affected",
"version": "4.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.0.25",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.1.22",
"status": "affected",
"version": "5.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.24",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.3.21",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.19",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.5.18",
"status": "affected",
"version": "5.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.6.17",
"status": "affected",
"version": "5.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.7.15",
"status": "affected",
"version": "5.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.8.13",
"status": "affected",
"version": "5.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.9.13",
"status": "affected",
"version": "5.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.12",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.10",
"status": "affected",
"version": "6.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.9",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.8",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.8",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.8",
"status": "affected",
"version": "6.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.5",
"status": "affected",
"version": "6.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.5",
"status": "affected",
"version": "6.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.6",
"status": "affected",
"version": "6.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.9.5",
"status": "affected",
"version": "6.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.2",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "moochi"
},
{
"lang": "en",
"type": "finder",
"value": "mappymappy"
}
],
"descriptions": [
{
"lang": "en",
"value": "WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T05:29:48.488Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve"
},
{
"url": "https://wordpress.org/news/2026/08/wordpress-7-0-3-release/"
},
{
"url": "https://core.trac.wordpress.org/changeset/63061"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WordPress Core \u003c= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-114570",
"datePublished": "2026-10-22T05:29:48.488Z",
"dateReserved": "2026-10-21T17:26:07.316Z",
"dateUpdated": "2026-10-22T05:29:48.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}