WordPress security changelog
HIGH CVE-2026-7543 Deferred

Breakdance form fields allow unauthenticated stored XSS

Breakdance 2.7.1 and earlier stores attacker-controlled fields content without sufficient sanitization and later outputs it without safe escaping. Public form submission makes the issue reachable without an account, allowing persistent script to execute when the affected content is viewed.

CVE / CNA score 7.2 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Breakdance
Plugin slug
breakdance
Affected
<= 2.7.1
Safe version
> 2.7.1
Published
Jul 16, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Jul 16, 2026 and is one of 7 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Breakdance to 2.7.2 or later and inspect stored form submissions for unexpected markup.

Source record

Technical description

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources