CVE WATCH / VULNERABILITY DETAIL
CVE-2026-114570
MEDIUMCVSS 4.9NVD feed
Published 22 October 2026 · tracked since 23 October 2026
Description
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in p
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog