---
id: CVE-2026-114570
title: >-
  WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site
  Scripting via Quick Edit
summary: >-
  WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in
  all versions up to, and including, 7.0.2 due to insufficient escaping of user
  display names. This makes it possible for authenticated attackers, with
  Contribut…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: WordPress Foundation
product: WordPress
affected:
  - WordPress >= 4.7.0 <= 4.7.33
  - WordPress >= 4.8.0 <= 4.8.28
  - WordPress >= 4.9.0 <= 4.9.29
  - WordPress >= 5.0.0 <= 5.0.25
  - WordPress >= 5.1.0 <= 5.1.22
  - WordPress >= 5.2.0 <= 5.2.24
  - WordPress >= 5.3.0 <= 5.3.21
  - WordPress >= 5.4.0 <= 5.4.19
  - WordPress >= 5.5.0 <= 5.5.18
  - WordPress >= 5.6.0 <= 5.6.17
  - WordPress >= 5.7.0 <= 5.7.15
  - WordPress >= 5.8.0 <= 5.8.13
  - WordPress >= 5.9.0 <= 5.9.13
  - WordPress >= 6.0.0 <= 6.0.12
  - WordPress >= 6.1.0 <= 6.1.10
  - WordPress >= 6.2.0 <= 6.2.9
  - WordPress >= 6.3.0 <= 6.3.8
  - WordPress >= 6.4.0 <= 6.4.8
  - WordPress >= 6.5.0 <= 6.5.8
  - WordPress >= 6.6.0 <= 6.6.5
  - WordPress >= 6.7.0 <= 6.7.5
  - WordPress >= 6.8.0 <= 6.8.6
  - WordPress >= 6.9.0 <= 6.9.5
  - WordPress >= 7.0.0 <= 7.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-22T13:33:19.865820Z'
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:10:33.995Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114570'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve
  - url: 'https://wordpress.org/news/2026/08/wordpress-7-0-3-release/'
  - url: 'https://core.trac.wordpress.org/changeset/63061'
tags:
  - cve.org
ingestedAt: '2026-10-22T06:30:48.520Z'
epss: 0.00225
epssPercentile: 0.13136
---

## Overview

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

## Affected

- `WordPress >= 4.7.0 <= 4.7.33`
- `WordPress >= 4.8.0 <= 4.8.28`
- `WordPress >= 4.9.0 <= 4.9.29`
- `WordPress >= 5.0.0 <= 5.0.25`
- `WordPress >= 5.1.0 <= 5.1.22`
- `WordPress >= 5.2.0 <= 5.2.24`
- `WordPress >= 5.3.0 <= 5.3.21`
- `WordPress >= 5.4.0 <= 5.4.19`
- `WordPress >= 5.5.0 <= 5.5.18`
- `WordPress >= 5.6.0 <= 5.6.17`
- `WordPress >= 5.7.0 <= 5.7.15`
- `WordPress >= 5.8.0 <= 5.8.13`
- `WordPress >= 5.9.0 <= 5.9.13`
- `WordPress >= 6.0.0 <= 6.0.12`
- `WordPress >= 6.1.0 <= 6.1.10`
- `WordPress >= 6.2.0 <= 6.2.9`
- `WordPress >= 6.3.0 <= 6.3.8`
- `WordPress >= 6.4.0 <= 6.4.8`
- `WordPress >= 6.5.0 <= 6.5.8`
- `WordPress >= 6.6.0 <= 6.6.5`
- `WordPress >= 6.7.0 <= 6.7.5`
- `WordPress >= 6.8.0 <= 6.8.6`
- `WordPress >= 6.9.0 <= 6.9.5`
- `WordPress >= 7.0.0 <= 7.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.