WordPress Vulnerabilities

WP < 7.0.3 - Author+ CSS Injection

Description

WordPress does not properly sanitise CSS in some cases, which could allow users with a role of Author and above to perform content injection in posts.

Affects WordPress

7.0.2
Fixed in WordPress 7.0.3
7.0.1
Fixed in WordPress 7.0.3
7.0
Fixed in WordPress 7.0.3
6.9.5
Fixed in WordPress 6.9.6
6.9.4
Fixed in WordPress 6.9.6
6.9.3
Fixed in WordPress 6.9.6
6.9.2
Fixed in WordPress 6.9.6
6.9.1
Fixed in WordPress 6.9.6
6.9
Fixed in WordPress 6.9.6
6.8.6
Fixed in WordPress 6.8.7
6.8.5
Fixed in WordPress 6.8.7
6.8.4
Fixed in WordPress 6.8.7
6.8.3
Fixed in WordPress 6.8.7
6.8.2
Fixed in WordPress 6.8.7
6.8.1
Fixed in WordPress 6.8.7
6.8
Fixed in WordPress 6.8.7
6.7.5
Fixed in WordPress 6.7.6
6.7.4
Fixed in WordPress 6.7.6
6.7.3
Fixed in WordPress 6.7.6
6.7.2
Fixed in WordPress 6.7.6
6.7.1
Fixed in WordPress 6.7.6
6.7
Fixed in WordPress 6.7.6
6.6.5
Fixed in WordPress 6.6.6
6.6.4
Fixed in WordPress 6.6.6
6.6.3
Fixed in WordPress 6.6.6
6.6.2
Fixed in WordPress 6.6.6
6.6.1
Fixed in WordPress 6.6.6
6.6
Fixed in WordPress 6.6.6
6.5.8
Fixed in WordPress 6.5.9
6.5.7
Fixed in WordPress 6.5.9
6.5.6
Fixed in WordPress 6.5.9
6.5.5
Fixed in WordPress 6.5.9
6.5.4
Fixed in WordPress 6.5.9
6.5.3
Fixed in WordPress 6.5.9
6.5.2
Fixed in WordPress 6.5.9
6.5
Fixed in WordPress 6.5.9
6.4.8
Fixed in WordPress 6.4.9
6.4.7
Fixed in WordPress 6.4.9
6.4.6
Fixed in WordPress 6.4.9
6.4.5
Fixed in WordPress 6.4.9
6.4.4
Fixed in WordPress 6.4.9
6.4.3
Fixed in WordPress 6.4.9
6.4.2
Fixed in WordPress 6.4.9
6.4.1
Fixed in WordPress 6.4.9
6.4
Fixed in WordPress 6.4.9
6.3.8
Fixed in WordPress 6.3.9
6.3.7
Fixed in WordPress 6.3.9
6.3.6
Fixed in WordPress 6.3.9
6.3.5
Fixed in WordPress 6.3.9
6.3.4
Fixed in WordPress 6.3.9
6.3.3
Fixed in WordPress 6.3.9
6.3.2
Fixed in WordPress 6.3.9
6.3.1
Fixed in WordPress 6.3.9
6.3
Fixed in WordPress 6.3.9
6.2.9
Fixed in WordPress 6.2.10
6.2.8
Fixed in WordPress 6.2.10
6.2.7
Fixed in WordPress 6.2.10
6.2.6
Fixed in WordPress 6.2.10
6.2.5
Fixed in WordPress 6.2.10
6.2.4
Fixed in WordPress 6.2.10
6.2.3
Fixed in WordPress 6.2.10
6.2.2
Fixed in WordPress 6.2.10
6.2.1
Fixed in WordPress 6.2.10
6.2
Fixed in WordPress 6.2.10
6.1.10
Fixed in WordPress 7.0.3
6.1.9
Fixed in WordPress 7.0.3
6.1.8
Fixed in WordPress 7.0.3
6.1.7
Fixed in WordPress 7.0.3
6.1.6
Fixed in WordPress 7.0.3
6.1.5
Fixed in WordPress 7.0.3
6.1.4
Fixed in WordPress 7.0.3
6.1.3
Fixed in WordPress 7.0.3
6.1.2
Fixed in WordPress 7.0.3
6.1.1
Fixed in WordPress 7.0.3
6.1
Fixed in WordPress 7.0.3

References

URL
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

Classification

Type
CONTENT INJECTION
OWASP top 10
A1: Injection
CWE
CWE-345
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
WordPress Security Team
Verified
Yes
WPVDB ID
1e4f9122-22b9-4fa2-913a-6e84d31ec14c

Timeline

Publicly Published
2026-08-06 (about 1 month ago)
Added
2026-08-06 (about 1 month ago)
Last Updated
2026-08-06 (about 1 month ago)

Other

Published
Title
Published
2026-01-15
Title
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit < 5.1.3 - Unauthenticated Order Status Manipulation
Published
2026-09-14
Title
Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter
Published
2026-08-15
Title
Product Table & List Builder For WooCommerce < 5.6.5 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter
Published
2021-07-12
Title
Frontend File Manager < 18.3 - Unauthenticated HTML Injection
Published
2026-04-29
Title
Five Star Restaurant Reservations < 2.7.17 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter