WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
WordPress Core is vulnerable to a stored cross-site scripting attack through the Quick Edit feature that allows authenticated users with contributor-level permissions to inject malicious scripts into user display names. When site administrators or other higher-privileged users access certain administrative screens, these injected scripts will execute, potentially compromising site security and user data.
Summarized by anthropic/claude-haiku-4.5. Verify details against the original sources.
Read the original description
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- WordPress Foundation WordPress
From 4.7.0 · through 4.7.33; From 4.8.0 · through 4.8.28; From 4.9.0 · through 4.9.29; From 5.0.0 · through 5.0.25; From 5.1.0 · through 5.1.22; From 5.2.0 · through 5.2.24; From 5.3.0 · through 5.3.21; From 5.4.0 · through 5.4.19; From 5.5.0 · through 5.5.18; From 5.6.0 · through 5.6.17; From 5.7.0 · through 5.7.15; From 5.8.0 · through 5.8.13; From 5.9.0 · through 5.9.13; From 6.0.0 · through 6.0.12; From 6.1.0 · through 6.1.10; From 6.2.0 · through 6.2.9; From 6.3.0 · through 6.3.8; From 6.4.0 · through 6.4.8; From 6.5.0 · through 6.5.8; From 6.6.0 · through 6.6.5; From 6.7.0 · through 6.7.5; From 6.8.0 · through 6.8.6; From 6.9.0 · through 6.9.5; From 7.0.0 · through 7.0.2