What’s Vulnerable › Vulnerabilities

CVE-2026-114570: WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-22
• Weakness: CWE-79

Description

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

Affected products

• WordPress: from 4.7.0 through 4.7.33; from 4.8.0 through 4.8.28; from 4.9.0 through 4.9.29; from 5.0.0 through 5.0.25; from 5.1.0 through 5.1.22; from 5.2.0 through 5.2.24

References

• https://core.trac.wordpress.org/changeset/63061
• https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve

Get alerted when CVE-2026-114570 or the next vulnerability affects your stack