WordPress core

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 4.7.0 through 4.7.33, 4.8.0 through 4.8.28, 4.9.0 through 4.9.29, 5.0.0 through 5.0.25, 5.1.0 through 5.1.22, 5.2.0 through 5.2.24, 5.3.0 through 5.3.21, 5.4.0 through 5.4.19, 5.5.0 through 5.5.18, 5.6.0 through 5.6.17, 5.7.0 through 5.7.15, 5.8.0 through 5.8.13, 5.9.0 through 5.9.13, 6.0.0 through 6.0.12, 6.1.0 through 6.1.10, 6.2.0 through 6.2.9, 6.3.0 through 6.3.8, 6.4.0 through 6.4.8, 6.5.0 through 6.5.8, 6.6.0 through 6.6.5, 6.7.0 through 6.7.5, 6.8.0 through 6.8.6, 6.9.0 through 6.9.5, 7.0.0 through 7.0.2. The narrative requires the later administrator or higher-privileged user action described above even though the vector records UI:N.

No attacker login is required. An attacker can obtain data that should not be exposed in the reachable response. The specific data fields, endpoint and request parameters are undisclosed. The supplied vector reports limited confidentiality impact. The vector requires no victim interaction. Affected versions: 7.1 through 7.1.2, 7.0 through 7.0.6, 6.9 through 6.9.9, 6.8 through 6.8.10, 6.7 through 6.7.9, 6.6 through 6.6.9. The authoritative export identifies 7.1.3, 7.0.7, 6.9.10, 6.8.11, 6.7.10, 6.6.10 as fixed for this CVE.

An unauthenticated attacker can influence get_page_template() so page-template resolution includes a chosen readable local PHP file outside the active theme directories. Executing attacker-controlled PHP requires the relevant server and active-theme prerequisites, which are not specified; neither an upload primitive nor an unconditional remote-code-execution path is established by this record. The request parameter and entry route are unspecified. Affected versions: < 7.1.2. Confirmed fixed release: 7.1.2.

Attacker-controlled comment content can reach unsafe page output in WordPress core, allowing script execution when a victim views the affected content. The current export classifies the issue as DOM-based XSS; the official security-release description identifies stored XSS in wpautop and says comment approval is required. Do not assume a general comment-approval bypass. The CNA vector permits an unauthenticated attacker and requires victim interaction. The export does not identify the exact comment field, request action or DOM sink. Use the fixed release for the installed branch, as listed in the mitigation guidance.

WordPress before 7.0.4 permits remote code execution when an Author or another user with the upload_files capability uploads a malicious PostScript file on a server that processes images with both Imagick and Ghostscript. The malicious file reaches that image-processing stack and can execute code on the server. WordPress 7.0.4 fixes the issue, and the fix was backported to maintained branches through 4.7.

WordPress fails to safely encode an attacker-supplied log username when a failed POST to /wp-login.php references a nonexistent account. A parser mismatch lets specially spaced tag-like text survive sanitize_user() and wp_strip_all_tags(), then become live HTML when login_header() and wp_admin_notice() render the invalid_username error through wp_kses_post(). This enables unauthenticated JavaScript execution in the WordPress origin. The published chain uses the login-page scripts, REST JSONP, Application Password authorization and plugin upload to reach PHP code execution, but it requires social engineering, active victim interaction and a suitably privileged Administrator who is already logged in. Patched releases call esc_html() before placing reflected usernames or email addresses into authentication errors.

A route-confusion weakness in the WordPress REST batch endpoint can be combined with the author__not_in SQL injection tracked as CVE-2026-60137. On affected WordPress 6.9 and 7.0 releases, an unauthenticated request can turn that chain into database compromise and potentially remote code execution.

Affected WordPress core releases do not safely handle author__not_in when untrusted input reaches WP_Query. The flaw becomes directly exploitable when a plugin, theme, or REST route forwards attacker-controlled values into that argument, and it is one half of the critical remote-code-execution chain tracked separately as CVE-2026-63030.

WordPress component is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

WordPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

various is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

the Avatar block in various is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress component is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.

WordPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress 2.5.1 and earlier might is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress 2.5 is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress component is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress component is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

WordPress component is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

wp-register.php in WordPress 2.0 and 2.0.1 is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress component is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress component is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WordPress 2.0.2 and earlier is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

WordPress 1.5.2, and possibly other versions before 2.0, is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

WordPress 2.0.0 is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress 1.5.1.3 and earlier is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

WordPress component is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.