---
id: "CVE-2026-114570"
kind: "vulnerability"
aliases: ["CVE-2026-114570"]
title: "WordPress Core: display names let contributors plant scripts in admin screens"
severity: "medium"
cvss: 4.9
epss: 0.0018
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["multi-user-sites", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "small-user-count"]
published_at: "2026-10-22T06:17:14+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:31:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114570", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114570", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# WordPress Core: display names let contributors plant scripts in admin screens

WordPress Core up to and including 7.0.2 does not escape user display names in Quick Edit, so stored script can be saved. When a higher-privileged user opens the affected admin screens, the script runs in their browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the WordPress version in the admin Dashboard or with `wp core version`
- Count users on the site: sites with a large number of users are the ones the sources say are affected
- unknown whether the sources name a specific setting or plugin condition beyond this

## Fix

- Update WordPress Core to a release later than `7.0.2`, using the version named in the official WordPress security release notes
- unknown whether the sources name the exact fixed version

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114570
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114570

## From the sources

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_