WordPress Vulnerabilities

WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Bind Directive Prototype Pollution

Description

WordPress does not reject prototype-mutating property names in Interactivity API bind directives in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session when the content is previewed. This also affects the Gutenberg plugin.

Affects WordPress

6.4.13
Fixed in WordPress 6.4.14
6.4.12
Fixed in WordPress 6.4.14
6.4.11
Fixed in WordPress 6.4.14
6.4.10
Fixed in WordPress 6.4.14
6.4.9
Fixed in WordPress 6.4.14
6.4.8
Fixed in WordPress 6.4.14
6.4.7
Fixed in WordPress 6.4.14
6.4.6
Fixed in WordPress 6.4.14
6.4.5
Fixed in WordPress 6.4.14
6.4.4
Fixed in WordPress 6.4.14
6.4.3
Fixed in WordPress 6.4.14
6.4.2
Fixed in WordPress 6.4.14
6.4.1
Fixed in WordPress 6.4.14
6.4
Fixed in WordPress 6.4.14
6.5.13
Fixed in WordPress 6.5.14
6.5.12
Fixed in WordPress 6.5.14
6.5.11
Fixed in WordPress 6.5.14
6.5.10
Fixed in WordPress 6.5.14
6.5.9
Fixed in WordPress 6.5.14
6.5.8
Fixed in WordPress 6.5.14
6.5.7
Fixed in WordPress 6.5.14
6.5.6
Fixed in WordPress 6.5.14
6.5.5
Fixed in WordPress 6.5.14
6.5.4
Fixed in WordPress 6.5.14
6.5.3
Fixed in WordPress 6.5.14
6.5.2
Fixed in WordPress 6.5.14
6.5
Fixed in WordPress 6.5.14
6.6.10
Fixed in WordPress 6.6.11
6.6.9
Fixed in WordPress 6.6.11
6.6.8
Fixed in WordPress 6.6.11
6.6.7
Fixed in WordPress 6.6.11
6.6.6
Fixed in WordPress 6.6.11
6.6.5
Fixed in WordPress 6.6.11
6.6.4
Fixed in WordPress 6.6.11
6.6.3
Fixed in WordPress 6.6.11
6.6.2
Fixed in WordPress 6.6.11
6.6.1
Fixed in WordPress 6.6.11
6.6
Fixed in WordPress 6.6.11
6.7.10
Fixed in WordPress 6.7.11
6.7.9
Fixed in WordPress 6.7.11
6.7.8
Fixed in WordPress 6.7.11
6.7.7
Fixed in WordPress 6.7.11
6.7.6
Fixed in WordPress 6.7.11
6.7.5
Fixed in WordPress 6.7.11
6.7.4
Fixed in WordPress 6.7.11
6.7.3
Fixed in WordPress 6.7.11
6.7.2
Fixed in WordPress 6.7.11
6.7.1
Fixed in WordPress 6.7.11
6.7
Fixed in WordPress 6.7.11
6.8.11
Fixed in WordPress 6.8.12
6.8.10
Fixed in WordPress 6.8.12
6.8.9
Fixed in WordPress 6.8.12
6.8.8
Fixed in WordPress 6.8.12
6.8.7
Fixed in WordPress 6.8.12
6.8.6
Fixed in WordPress 6.8.12
6.8.5
Fixed in WordPress 6.8.12
6.8.4
Fixed in WordPress 6.8.12
6.8.3
Fixed in WordPress 6.8.12
6.8.2
Fixed in WordPress 6.8.12
6.8.1
Fixed in WordPress 6.8.12
6.8
Fixed in WordPress 6.8.12
6.9.10
Fixed in WordPress 6.9.11
6.9.9
Fixed in WordPress 6.9.11
6.9.8
Fixed in WordPress 6.9.11
6.9.7
Fixed in WordPress 6.9.11
6.9.6
Fixed in WordPress 6.9.11
6.9.5
Fixed in WordPress 6.9.11
6.9.4
Fixed in WordPress 6.9.11
6.9.3
Fixed in WordPress 6.9.11
6.9.2
Fixed in WordPress 6.9.11
6.9.1
Fixed in WordPress 6.9.11
6.9
Fixed in WordPress 6.9.11
7.0.7
Fixed in WordPress 7.0.8
7.0.6
Fixed in WordPress 7.0.8
7.0.5
Fixed in WordPress 7.0.8
7.0.4
Fixed in WordPress 7.0.8
7.0.3
Fixed in WordPress 7.0.8
7.0.2
Fixed in WordPress 7.0.8
7.0.1
Fixed in WordPress 7.0.8
7.0
Fixed in WordPress 7.0.8
7.1.3
Fixed in WordPress 7.1.4
7.1.2
Fixed in WordPress 7.1.4
7.1.1
Fixed in WordPress 7.1.4
7.1
Fixed in WordPress 7.1.4

Affects Plugins

Plugin icon
gutenberg
Fixed in 24.3.0

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-4/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Marcel Karlsson
Verified
Yes
WPVDB ID
392e29c4-aafd-4eff-9d71-57e707459b39

Timeline

Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 17 hours ago)
Last Updated
2026-10-29 (about 17 hours ago)

Other

Published
Title
Published
2014-04-25
Title
Game Tabs <= 0.4.0 - XSS
Published
2020-09-17
Title
MetaSlider < 3.17.2 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2024-07-10
Title
ReCaptcha Integration for WordPress < 1.2.8 - Admin+ Stored XSS
Published
2021-08-18
Title
Jock on air now < 5.6.3 - Authenticated Stored Cross-Site Scripting
Published
2024-03-06
Title
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin < 3.1.5 - Unauthenticated Stored Self-Based Cross-Site Scripting