WordPress Vulnerabilities

WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Content Block

Description

Gutenberg does not restrict a block attribute used as an HTML tag name, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against anyone viewing the affected post. The affected block ships both in the Gutenberg plugin and, bundled, in WordPress core.

Affects WordPress

7.0.2
Fixed in WordPress 7.0.3
7.0.1
Fixed in WordPress 7.0.3
7.0
Fixed in WordPress 7.0.3
6.9.5
Fixed in WordPress 6.9.6
6.9.4
Fixed in WordPress 6.9.6
6.9.3
Fixed in WordPress 6.9.6
6.9.2
Fixed in WordPress 6.9.6
6.9.1
Fixed in WordPress 6.9.6
6.9
Fixed in WordPress 6.9.6

Affects Plugins

Plugin icon
gutenberg
Fixed in 23.7.1

References

URL
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
N05ec@LZU
Verified
Yes
WPVDB ID
0e68351c-aba1-4953-92a3-ebeb72d53847

Timeline

Publicly Published
2026-08-06 (about 1 month ago)
Added
2026-08-07 (about 1 month ago)
Last Updated
2026-08-07 (about 1 month ago)

Other

Published
Title
Published
2026-07-06
Title
reCAPTCHA for Asgaros Forum < 1.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2024-11-08
Title
Fast Video and Image Display <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-08-21
Title
Video Gallery – Vimeo and YouTube Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-12-29
Title
10WebMapBuilder < 1.0.72 - Contributor+ Stored XSS via Shortcode
Published
2026-06-23
Title
Cincopa video and media plug-in <= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments