Live › vulnerability › CVE-2026-114570
Go to dashboardWordPress Core up to and including 7.0.2 does not escape user display names in Quick Edit, so stored script can be saved. When a higher-privileged user opens the affected admin screens, the script runs in their browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running WordPress Core 7.0.2 or earlier with a large number of users, where Contributor-level or higher accounts exist. The attacker needs a logged-in Contributor account and an administrator or editor must then open the affected screens. Small sites with few users are stated as not affected.
No product ranges from the sources yet.
wp core version7.0.2, using the version named in the official WordPress security release notesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
This page as .md · .json · in your agent: get_signal("CVE-2026-114570")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.