WordPress Vulnerabilities

WP < 7.0.3 - Contributor+ Stored XSS via Emoji Settings Element

Description

WordPress does not properly restrict the content of submitted posts in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against users previewing the post.

Affects WordPress

7.0.2
Fixed in WordPress 7.0.3
7.0.1
Fixed in WordPress 7.0.3
7.0
Fixed in WordPress 7.0.3
6.9.5
Fixed in WordPress 6.9.6
6.9.4
Fixed in WordPress 6.9.6
6.9.3
Fixed in WordPress 6.9.6
6.9.2
Fixed in WordPress 6.9.6
6.9.1
Fixed in WordPress 6.9.6
6.9
Fixed in WordPress 6.9.6

References

URL
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Asaf Mozes (amosec)
Verified
Yes
WPVDB ID
3d6b8acc-ea6e-4298-872a-15ac4310be68

Timeline

Publicly Published
2026-08-06 (about 1 month ago)
Added
2026-08-06 (about 1 month ago)
Last Updated
2026-08-06 (about 1 month ago)

Other

Published
Title
Published
2022-05-02
Title
Check & Log email < 1.0.6 - Reflected Cross-Site Scripting
Published
2024-01-26
Title
Meks Smart Social Widget < 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2012-04-20
Title
WordPress 2.5 - 3.3.1 XSS in swfupload
Published
2024-08-01
Title
LiquidPoll – Advanced Polls for Creators and Brands < 3.3.78 - Unauthenticated Stored Cross-Site Scripting
Published
2026-07-08
Title
CRM Perks Forms < 1.1.8 - Reflected Cross-Site Scripting