WordPress core: Stored and DOM-based XSS through comments
Attacker-controlled comment content can reach unsafe page output in WordPress core, allowing script execution when a victim views the affected content. The current export classifies the issue as DOM-based XSS; the official security-release description identifies stored XSS in wpautop and says comment approval is required. Do not assume a general comment-approval bypass. The CNA vector permits an unauthenticated attacker and requires victim interaction. The export does not identify the exact comment field, request action or DOM sink. Use the fixed release for the installed branch, as listed in the mitigation guidance.
- Component
- WordPress
- Plugin slug
Core- Affected
- 7.1, 7.0 through 7.0.4, 6.9 through 6.9.7, 6.8 through 6.8.8, 6.7 through 6.7.7, 6.6 through 6.6.7, 6.5 through 6.5.10, 6.4 through 6.4.10, 6.3 through 6.3.10, 6.2 through 6.2.11, 6.1 through 6.1.12, 6.0 through 6.0.14, 5.9 through 5.9.16, 5.8 through 5.8.15, 5.7 through 5.7.17, 5.6 through 5.6.19, 5.5 through 5.5.20, 5.4 through 5.4.21, 5.3 through 5.3.23, 5.2 through 5.2.26, 5.1 through 5.1.24, 5.0 through 5.0.27, 4.9 through 4.9.31, 4.8 through 4.8.30, 4.7 through 4.7.35
- Safe version
7.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, 5.2.27, 5.1.25, 5.0.28, 4.9.32, 4.8.31, 4.7.36- Published
- Sep 18, 2026
This CVE was published Sep 18, 2026 and is one of 51 known issues for WordPress core.
Update, patch or deactivate.
Use the fixed release for the corresponding branch: 7.1 to < 7.1.1 → 7.1.1; 7.0 through 7.0.4 → 7.0.5; 6.9 through 6.9.7 → 6.9.8; 6.8 through 6.8.8 → 6.8.9; 6.7 through 6.7.7 → 6.7.8; 6.6 through 6.6.7 → 6.6.8; 6.5 through 6.5.10 → 6.5.11; 6.4 through 6.4.10 → 6.4.11; 6.3 through 6.3.10 → 6.3.11; 6.2 through 6.2.11 → 6.2.12; 6.1 through 6.1.12 → 6.1.13; 6.0 through 6.0.14 → 6.0.15; 5.9 through 5.9.16 → 5.9.17; 5.8 through 5.8.15 → 5.8.16; 5.7 through 5.7.17 → 5.7.18; 5.6 through 5.6.19 → 5.6.20; 5.5 through 5.5.20 → 5.5.21; 5.4 through 5.4.21 → 5.4.22; 5.3 through 5.3.23 → 5.3.24; 5.2 through 5.2.26 → 5.2.27; 5.1 through 5.1.24 → 5.1.25; 5.0 through 5.0.27 → 5.0.28; 4.9 through 4.9.31 → 4.9.32; 4.8 through 4.8.30 → 4.8.31; 4.7 through 4.7.35 → 4.7.36. A fixed version in one branch is not a substitute for its counterpart in another branch. Install the security release for the site's supported WordPress branch, or upgrade to the latest supported branch. Treat comment content as untrusted throughout server rendering and DOM insertion, using context-appropriate sanitization and safe DOM APIs; pending an update, restrict public comment submission.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L