WordPress Core Vulnerability (CVE-2026-114570)

Security Alert Summary

WordPress Core contains a stored cross-site scripting (XSS) vulnerability in the Quick Edit feature affecting versions up to and including 7.0.2. Insufficient escaping of user display names allows an authenticated user with Contributor-level access or higher to inject scripts that execute when higher-privileged users view certain administrative screens. The issue is noted to affect sites with a large number of users.

CVE Details

• CVE ID: CVE-2026-114570
• Affected component: WordPress Core (Quick Edit handling of user display names)
• Affected versions: All affected versions up to and including 7.0.2. Specific affected ranges listed in the advisory include:
  • 4.7.0 - 4.7.33
  • 4.8.0 - 4.8.28
  • 4.9.0 - 4.9.29
  • 5.0.0 - 5.0.25
  • 5.1.0 - 5.1.22
  • 5.2.0 - 5.2.24
  • 5.3.0 - 5.3.21
  • 5.4.0 - 5.4.19
  • 5.5.0 - 5.5.18
  • 5.6.0 - 5.6.17
  • 5.7.0 - 5.7.15
  • 5.8.0 - 5.8.13
  • 5.9.0 - 5.9.13
  • 6.0.0 - 6.0.12
  • 6.1.0 - 6.1.10
  • 6.2.0 - 6.2.9
  • 6.3.0 - 6.3.8
  • 6.4.0 - 6.4.8
  • 6.5.0 - 6.5.8
  • 6.6.0 - 6.6.5
  • 6.7.0 - 6.7.5
  • 6.8.0 - 6.8.6
  • 6.9.0 - 6.9.5
  • 7.0.0 - 7.0.2
• Published: October 22, 2026 at 6:17:14 AM UTC
• Last modified: October 22, 2026 at 3:15:23 PM UTC
• CVSS v3.1: Base Score 4.9, Severity MEDIUM
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: LOW (authenticated user with contributor-level access or higher)
  • User Interaction: NONE
  • Scope: CHANGED
• Authentication requirements: Authentication is required; an attacker must have an account with low privileges (Contributor-level or higher) to exploit the issue.
• Primary impact:
  • Confidentiality: LOW
  • Integrity: LOW
  • Availability: NONE
• Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)

Technical Details

This is a stored cross-site scripting issue in the Quick Edit functionality of WordPress Core. The vulnerability exists because user display names are insufficiently escaped when rendered in certain Quick Edit administrative screens. An authenticated user with contributor-level access or higher can supply a crafted display name containing script content that is stored and later rendered in the admin interface.

When a higher-privileged user opens the affected administrative screens, the injected script can execute in the context of that user’s browser. The CVE description specifies Quick Edit and user display names as the vector; no specific function names or REST API endpoints are provided in the available data.

The impact is limited to the ability to execute scripts in the admin UI as viewed by privileged users. The issue is noted to affect sites with a large number of users, where contributor or low-privilege accounts may be able to influence displayed content viewed by higher-privileged accounts.

How This Could Impact Your Website

Consider a scenario where a site owner, several internal editors, and an external contractor all have accounts on the site. An attacker who can register or control a Contributor-level account could set a crafted display name that stores malicious script content. When an editor or administrator uses Quick Edit or views the affected admin screens, that script could run in their browser.

Practical consequences include potential exposure of internal user information visible in the admin UI and increased risk of targeted phishing or social engineering against staff whose accounts are visible to the attacker. The impact described in the advisory is limited to confidentiality and integrity at a low level and does not indicate direct site availability loss.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

• Update WordPress Core to a patched version as soon as an official fix is available.
• Review and reduce unnecessary user roles, especially Contributor accounts and other low-privilege roles with profile fields visible in the admin UI.
• Enforce strong passwords and enable two-factor authentication for editors and administrators.
• Remove unused or unmaintained accounts and plugins to reduce attack surface.
• Monitor site activity and admin logs for unusual behavior, including unexpected changes to user display names or profile fields.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://core.trac.wordpress.org/changeset/63061
• https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=cve