Stored Cross-Site Scripting Vulnerability in WordPress Core - Affects User Display Names
CVE-2026-114570

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
WordPress
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114570?

The WordPress Core is susceptible to a Stored Cross-Site Scripting (XSS) attack through the Quick Edit feature, impacting all versions up to and including 7.0.2. This vulnerability arises from inadequate escaping of user display names, enabling authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts can execute when a user with higher privileges visits the affected administrative screens. This issue particularly poses a risk for sites with a large user base, making it essential for administrators to ensure their systems are updated and secure against this potential exploitation.

Affected Version(s)

WordPress 4.7.0 <= 4.7.33

WordPress 4.8.0 <= 4.8.28

WordPress 4.9.0 <= 4.9.29

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
https://core.trac.wordpress.org/changeset/63061

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

moochi
mappymappy
.