Description (CNA)
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WordPress Foundation / WordPress | affected 4.7.0 through 4.7.33; affected 4.8.0 through 4.8.28; affected 4.9.0 through 4.9.29; affected 5.0.0 through 5.0.25; affected 5.1.0 through 5.1.22; affected 5.2.0 through 5.2.24; affected 5.3.0 through 5.3.21; affected 5.4.0 through 5.4.19; affected 5.5.0 through 5.5.18; affected 5.6.0 through 5.6.17; affected 5.7.0 through 5.7.15; affected 5.8.0 through 5.8.13; affected 5.9.0 through 5.9.13; affected 6.0.0 through 6.0.12; affected 6.1.0 through 6.1.10; affected 6.2.0 through 6.2.9; affected 6.3.0 through 6.3.8; affected 6.4.0 through 6.4.8; affected 6.5.0 through 6.5.8; affected 6.6.0 through 6.6.5; affected 6.7.0 through 6.7.5; affected 6.8.0 through 6.8.6; affected 6.9.0 through 6.9.5; affected 7.0.0 through 7.0.2 |
CWE
CWE-79
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve
- https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
- https://core.trac.wordpress.org/changeset/63061
ADP enrichment
No English description supplied.
No references supplied.