CVE-2026-114570
published 2026-10-22CVE-2026-114570: WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user…
PriorityP425medium4.9CVSS 3.1
AVNACHPRLUINSCCLILAN
EPSS
0.18%
7.2th percentile
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wordpress_foundation | wordpress | 4.7.0 – 4.7.33 | — |
| wordpress_foundation | wordpress | 4.8.0 – 4.8.28 | — |
| wordpress_foundation | wordpress | 4.9.0 – 4.9.29 | — |
| wordpress_foundation | wordpress | 5.0.0 – 5.0.25 | — |
| wordpress_foundation | wordpress | 5.1.0 – 5.1.22 | — |
| wordpress_foundation | wordpress | 5.2.0 – 5.2.24 | — |
| wordpress_foundation | wordpress | 5.3.0 – 5.3.21 | — |
| wordpress_foundation | wordpress | 5.4.0 – 5.4.19 | — |
| wordpress_foundation | wordpress | 5.5.0 – 5.5.18 | — |
| wordpress_foundation | wordpress | 5.6.0 – 5.6.17 | — |
| wordpress_foundation | wordpress | 5.7.0 – 5.7.15 | — |
| wordpress_foundation | wordpress | 5.8.0 – 5.8.13 | — |
| wordpress_foundation | wordpress | 5.9.0 – 5.9.13 | — |
| wordpress_foundation | wordpress | 6.0.0 – 6.0.12 | — |
| wordpress_foundation | wordpress | 6.1.0 – 6.1.10 | — |
| wordpress_foundation | wordpress | 6.2.0 – 6.2.9 | — |
| wordpress_foundation | wordpress | 6.3.0 – 6.3.8 | — |
| wordpress_foundation | wordpress | 6.4.0 – 6.4.8 | — |
| wordpress_foundation | wordpress | 6.5.0 – 6.5.8 | — |
| wordpress_foundation | wordpress | 6.6.0 – 6.6.5 | — |
| wordpress_foundation | wordpress | 6.7.0 – 6.7.5 | — |
| wordpress_foundation | wordpress | 6.8.0 – 6.8.6 | — |
| wordpress_foundation | wordpress | 6.9.0 – 6.9.5 | — |
| wordpress_foundation | wordpress | 7.0.0 – 7.0.2 | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit
vendor_redhat·2026-10-22·CVSS 4.9
CVE-2026-114570 [MEDIUM] CWE-79 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit
wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
A flaw was found in WordPress. Insufficient escaping of user display names in the Quick Edit feature allows an authenticated user with contributor-level privileges to conduct stored Cross-Site Scripting (XSS) attacks. By submitting malicious s
GHSA
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names.
ghsa_unreviewed·2026-10-22
CVE-2026-114570 [MEDIUM] CWE-79 WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [fedora-44]
bugzilla·2026-10-22·CVSS 4.9
CVE-2026-114570 [MEDIUM] CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [fedora-44]
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number o
Bugzilla
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [epel-9]
bugzilla·2026-10-22·CVSS 4.9
CVE-2026-114570 [MEDIUM] CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [epel-9]
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of u
Bugzilla
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [fedora-rawhide]
bugzilla·2026-10-22·CVSS 4.9
CVE-2026-114570 [MEDIUM] CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [fedora-rawhide]
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large num
Bugzilla
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit
bugzilla·2026-10-22·CVSS 4.9
CVE-2026-114570 [MEDIUM] CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
Bugzilla
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [fedora-43]
bugzilla·2026-10-22·CVSS 4.9
CVE-2026-114570 [MEDIUM] CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [fedora-43]
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number o
Bugzilla
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [epel-10]
bugzilla·2026-10-22·CVSS 4.9
CVE-2026-114570 [MEDIUM] CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [epel-10]
CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of
2026-10-22
Published