CVE-2026-114570
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
CVSS Score
4.9
EPSS Score
0.0%
EPSS Percentile
0th
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
| CWE | CWE-79 |
| Vendor | wordpress foundation |
| Product | wordpress |
| Ecosystems | |
| Industries | WebMedia |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for wordpress foundation wordpress
Be the first to know when new medium vulnerabilities affecting wordpress foundation wordpress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
WordPress Foundation / WordPress
4.7.0 ≤ 4.7.33 4.8.0 ≤ 4.8.28 4.9.0 ≤ 4.9.29 5.0.0 ≤ 5.0.25 5.1.0 ≤ 5.1.22 5.2.0 ≤ 5.2.24 5.3.0 ≤ 5.3.21 5.4.0 ≤ 5.4.19 5.5.0 ≤ 5.5.18 5.6.0 ≤ 5.6.17 5.7.0 ≤ 5.7.15 5.8.0 ≤ 5.8.13 5.9.0 ≤ 5.9.13 6.0.0 ≤ 6.0.12 6.1.0 ≤ 6.1.10 6.2.0 ≤ 6.2.9 6.3.0 ≤ 6.3.8 6.4.0 ≤ 6.4.8 6.5.0 ≤ 6.5.8 6.6.0 ≤ 6.6.5 6.7.0 ≤ 6.7.5 6.8.0 ≤ 6.8.6 6.9.0 ≤ 6.9.5 7.0.0 ≤ 7.0.2
References
Credits
moochi mappymappy