CVE-2026-114570Medium· 4.9▾ SunlitWordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contribut…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
WordPress >= 4.7.0 <= 4.7.33WordPress >= 4.8.0 <= 4.8.28WordPress >= 4.9.0 <= 4.9.29WordPress >= 5.0.0 <= 5.0.25WordPress >= 5.1.0 <= 5.1.22WordPress >= 5.2.0 <= 5.2.24WordPress >= 5.3.0 <= 5.3.21WordPress >= 5.4.0 <= 5.4.19WordPress >= 5.5.0 <= 5.5.18WordPress >= 5.6.0 <= 5.6.17WordPress >= 5.7.0 <= 5.7.15WordPress >= 5.8.0 <= 5.8.13WordPress >= 5.9.0 <= 5.9.13WordPress >= 6.0.0 <= 6.0.12WordPress >= 6.1.0 <= 6.1.10WordPress >= 6.2.0 <= 6.2.9WordPress >= 6.3.0 <= 6.3.8WordPress >= 6.4.0 <= 6.4.8WordPress >= 6.5.0 <= 6.5.8WordPress >= 6.6.0 <= 6.6.5WordPress >= 6.7.0 <= 6.7.5WordPress >= 6.8.0 <= 6.8.6WordPress >= 6.9.0 <= 6.9.5WordPress >= 7.0.0 <= 7.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93485High· 7.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 throug…
CVE-2026-66666Medium· 6.9Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from …
CVE-2023-39999Medium· 4.3Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9…
CVE-2026-87902High· 8.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories
CVE-2026-63030Critical· 9.8WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL In…
CVE-2026-60137Medium· 5.9WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.