All vulnerabilities
CVE-2026-114570

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

WordPress Foundation WordPressApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

Text from CVE List

Affected versions 24

  • WordPressaffected: 4.7.0 through 4.7.33CVE List
  • WordPressaffected: 4.8.0 through 4.8.28CVE List
  • WordPressaffected: 4.9.0 through 4.9.29CVE List
  • WordPressaffected: 5.0.0 through 5.0.25CVE List
  • WordPressaffected: 5.1.0 through 5.1.22CVE List
  • WordPressaffected: 5.2.0 through 5.2.24CVE List
  • WordPressaffected: 5.3.0 through 5.3.21CVE List
  • WordPressaffected: 5.4.0 through 5.4.19CVE List
  • WordPressaffected: 5.5.0 through 5.5.18CVE List
  • WordPressaffected: 5.6.0 through 5.6.17CVE List
  • WordPressaffected: 5.7.0 through 5.7.15CVE List
  • WordPressaffected: 5.8.0 through 5.8.13CVE List
  • WordPressaffected: 5.9.0 through 5.9.13CVE List
  • WordPressaffected: 6.0.0 through 6.0.12CVE List
  • WordPressaffected: 6.1.0 through 6.1.10CVE List
  • WordPressaffected: 6.2.0 through 6.2.9CVE List
  • WordPressaffected: 6.3.0 through 6.3.8CVE List
  • WordPressaffected: 6.4.0 through 6.4.8CVE List
  • WordPressaffected: 6.5.0 through 6.5.8CVE List
  • WordPressaffected: 6.6.0 through 6.6.5CVE List
  • WordPressaffected: 6.7.0 through 6.7.5CVE List
  • WordPressaffected: 6.8.0 through 6.8.6CVE List
  • WordPressaffected: 6.9.0 through 6.9.5CVE List
  • WordPressaffected: 7.0.0 through 7.0.2CVE List

References 3