blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-114570

MEDIUM 4.9 CVSS 3.1
Published
October 22, 2026
Last modified
October 22, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Description

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

Affected WordPress components

  • wordpress Plugin · wordpress
    Possible match Homeless
    From 4.7.0 (including) to 4.7.33 (including); From 4.8.0 (including) to 4.8.28 (including); From 4.9.0 (including) to 4.9.29 (including); From 5.0.0 (including) to 5.0.25 (including); From 5.1.0 (including) to 5.1.22 (including); From 5.2.0 (including) to 5.2.24 (including); From 5.3.0 (including) to 5.3.21 (including); From 5.4.0 (including) to 5.4.19 (including); From 5.5.0 (including) to 5.5.18 (including); From 5.6.0 (including) to 5.6.17 (including); From 5.7.0 (including) to 5.7.15 (including); From 5.8.0 (including) to 5.8.13 (including); From 5.9.0 (including) to 5.9.13 (including); From 6.0.0 (including) to 6.0.12 (including); From 6.1.0 (including) to 6.1.10 (including); From 6.2.0 (including) to 6.2.9 (including); From 6.3.0 (including) to 6.3.8 (including); From 6.4.0 (including) to 6.4.8 (including); From 6.5.0 (including) to 6.5.8 (including); From 6.6.0 (including) to 6.6.5 (including); From 6.7.0 (including) to 6.7.5 (including); From 6.8.0 (including) to 6.8.6 (including); From 6.9.0 (including) to 6.9.5 (including); From 7.0.0 (including) to 7.0.2 (including)
    View on WordPress.org
  • wordpress Theme · wordpress
    Possible match Homeless
    From 4.7.0 (including) to 4.7.33 (including); From 4.8.0 (including) to 4.8.28 (including); From 4.9.0 (including) to 4.9.29 (including); From 5.0.0 (including) to 5.0.25 (including); From 5.1.0 (including) to 5.1.22 (including); From 5.2.0 (including) to 5.2.24 (including); From 5.3.0 (including) to 5.3.21 (including); From 5.4.0 (including) to 5.4.19 (including); From 5.5.0 (including) to 5.5.18 (including); From 5.6.0 (including) to 5.6.17 (including); From 5.7.0 (including) to 5.7.15 (including); From 5.8.0 (including) to 5.8.13 (including); From 5.9.0 (including) to 5.9.13 (including); From 6.0.0 (including) to 6.0.12 (including); From 6.1.0 (including) to 6.1.10 (including); From 6.2.0 (including) to 6.2.9 (including); From 6.3.0 (including) to 6.3.8 (including); From 6.4.0 (including) to 6.4.8 (including); From 6.5.0 (including) to 6.5.8 (including); From 6.6.0 (including) to 6.6.5 (including); From 6.7.0 (including) to 6.7.5 (including); From 6.8.0 (including) to 6.8.6 (including); From 6.9.0 (including) to 6.9.5 (including); From 7.0.0 (including) to 7.0.2 (including)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • WordPress Foundation WordPress — From 4.7.0 (including) to 4.7.33 (including)
  • WordPress Foundation WordPress — From 4.8.0 (including) to 4.8.28 (including)
  • WordPress Foundation WordPress — From 4.9.0 (including) to 4.9.29 (including)
  • WordPress Foundation WordPress — From 5.0.0 (including) to 5.0.25 (including)
  • WordPress Foundation WordPress — From 5.1.0 (including) to 5.1.22 (including)
  • WordPress Foundation WordPress — From 5.2.0 (including) to 5.2.24 (including)
  • WordPress Foundation WordPress — From 5.3.0 (including) to 5.3.21 (including)
  • WordPress Foundation WordPress — From 5.4.0 (including) to 5.4.19 (including)
  • WordPress Foundation WordPress — From 5.5.0 (including) to 5.5.18 (including)
  • WordPress Foundation WordPress — From 5.6.0 (including) to 5.6.17 (including)
  • WordPress Foundation WordPress — From 5.7.0 (including) to 5.7.15 (including)
  • WordPress Foundation WordPress — From 5.8.0 (including) to 5.8.13 (including)
  • WordPress Foundation WordPress — From 5.9.0 (including) to 5.9.13 (including)
  • WordPress Foundation WordPress — From 6.0.0 (including) to 6.0.12 (including)
  • WordPress Foundation WordPress — From 6.1.0 (including) to 6.1.10 (including)
  • WordPress Foundation WordPress — From 6.2.0 (including) to 6.2.9 (including)
  • WordPress Foundation WordPress — From 6.3.0 (including) to 6.3.8 (including)
  • WordPress Foundation WordPress — From 6.4.0 (including) to 6.4.8 (including)
  • WordPress Foundation WordPress — From 6.5.0 (including) to 6.5.8 (including)
  • WordPress Foundation WordPress — From 6.6.0 (including) to 6.6.5 (including)
  • WordPress Foundation WordPress — From 6.7.0 (including) to 6.7.5 (including)
  • WordPress Foundation WordPress — From 6.8.0 (including) to 6.8.6 (including)
  • WordPress Foundation WordPress — From 6.9.0 (including) to 6.9.5 (including)
  • WordPress Foundation WordPress — From 7.0.0 (including) to 7.0.2 (including)

References