---
id: CVE-2026-114570
title: >-
  WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site
  Scripting via Quick Edit
summary: >-
  WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in
  all versions up to, and including, 7.0.2 due to insufficient escaping of user
  display names. This makes it possible for authenticated attackers, with
  Contribut…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: WordPress Foundation
product: WordPress
affected:
  - WordPress >= 4.7.0 <= 4.7.33
  - WordPress >= 4.8.0 <= 4.8.28
  - WordPress >= 4.9.0 <= 4.9.29
  - WordPress >= 5.0.0 <= 5.0.25
  - WordPress >= 5.1.0 <= 5.1.22
  - WordPress >= 5.2.0 <= 5.2.24
  - WordPress >= 5.3.0 <= 5.3.21
  - WordPress >= 5.4.0 <= 5.4.19
  - WordPress >= 5.5.0 <= 5.5.18
  - WordPress >= 5.6.0 <= 5.6.17
  - WordPress >= 5.7.0 <= 5.7.15
  - WordPress >= 5.8.0 <= 5.8.13
  - WordPress >= 5.9.0 <= 5.9.13
  - WordPress >= 6.0.0 <= 6.0.12
  - WordPress >= 6.1.0 <= 6.1.10
  - WordPress >= 6.2.0 <= 6.2.9
  - WordPress >= 6.3.0 <= 6.3.8
  - WordPress >= 6.4.0 <= 6.4.8
  - WordPress >= 6.5.0 <= 6.5.8
  - WordPress >= 6.6.0 <= 6.6.5
  - WordPress >= 6.7.0 <= 6.7.5
  - WordPress >= 6.8.0 <= 6.8.6
  - WordPress >= 6.9.0 <= 6.9.5
  - WordPress >= 7.0.0 <= 7.0.2
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T05:29:48.488Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114570'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve
  - url: 'https://wordpress.org/news/2026/08/wordpress-7-0-3-release/'
  - url: 'https://core.trac.wordpress.org/changeset/63061'
tags:
  - cve.org
ingestedAt: '2026-10-22T06:30:48.520Z'
---

## Overview

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

## Affected

- `WordPress >= 4.7.0 <= 4.7.33`
- `WordPress >= 4.8.0 <= 4.8.28`
- `WordPress >= 4.9.0 <= 4.9.29`
- `WordPress >= 5.0.0 <= 5.0.25`
- `WordPress >= 5.1.0 <= 5.1.22`
- `WordPress >= 5.2.0 <= 5.2.24`
- `WordPress >= 5.3.0 <= 5.3.21`
- `WordPress >= 5.4.0 <= 5.4.19`
- `WordPress >= 5.5.0 <= 5.5.18`
- `WordPress >= 5.6.0 <= 5.6.17`
- `WordPress >= 5.7.0 <= 5.7.15`
- `WordPress >= 5.8.0 <= 5.8.13`
- `WordPress >= 5.9.0 <= 5.9.13`
- `WordPress >= 6.0.0 <= 6.0.12`
- `WordPress >= 6.1.0 <= 6.1.10`
- `WordPress >= 6.2.0 <= 6.2.9`
- `WordPress >= 6.3.0 <= 6.3.8`
- `WordPress >= 6.4.0 <= 6.4.8`
- `WordPress >= 6.5.0 <= 6.5.8`
- `WordPress >= 6.6.0 <= 6.6.5`
- `WordPress >= 6.7.0 <= 6.7.5`
- `WordPress >= 6.8.0 <= 6.8.6`
- `WordPress >= 6.9.0 <= 6.9.5`
- `WordPress >= 7.0.0 <= 7.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.