WordPress Vulnerabilities

WP 5.9 - 7.1.3 - Contributor+ Stored XSS via Comments Pagination Next Block

Description

WordPress does not escape a block attribute in a comments pagination block in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks against site visitors. This also affects the Gutenberg plugin.

Affects WordPress

5.9.19
Fixed in WordPress 5.9.20
5.9.18
Fixed in WordPress 5.9.20
5.9.17
Fixed in WordPress 5.9.20
5.9.16
Fixed in WordPress 5.9.20
5.9.15
Fixed in WordPress 5.9.20
5.9.14
Fixed in WordPress 5.9.20
5.9.13
Fixed in WordPress 5.9.20
5.9.12
Fixed in WordPress 5.9.20
5.9.11
Fixed in WordPress 5.9.20
5.9.10
Fixed in WordPress 5.9.20
5.9.9
Fixed in WordPress 5.9.20
5.9.8
Fixed in WordPress 5.9.20
5.9.7
Fixed in WordPress 5.9.20
5.9.6
Fixed in WordPress 5.9.20
5.9.5
Fixed in WordPress 5.9.20
5.9.4
Fixed in WordPress 5.9.20
5.9.3
Fixed in WordPress 5.9.20
5.9.2
Fixed in WordPress 5.9.20
5.9.1
Fixed in WordPress 5.9.20
5.9
Fixed in WordPress 5.9.20
6.0.17
Fixed in WordPress 6.0.18
6.0.16
Fixed in WordPress 6.0.18
6.0.15
Fixed in WordPress 6.0.18
6.0.14
Fixed in WordPress 6.0.18
6.0.13
Fixed in WordPress 6.0.18
6.0.12
Fixed in WordPress 6.0.18
6.0.11
Fixed in WordPress 6.0.18
6.0.10
Fixed in WordPress 6.0.18
6.0.9
Fixed in WordPress 6.0.18
6.0.8
Fixed in WordPress 6.0.18
6.0.7
Fixed in WordPress 6.0.18
6.0.6
Fixed in WordPress 6.0.18
6.0.5
Fixed in WordPress 6.0.18
6.0.4
Fixed in WordPress 6.0.18
6.0.3
Fixed in WordPress 6.0.18
6.0.2
Fixed in WordPress 6.0.18
6.0.1
Fixed in WordPress 6.0.18
6.0
Fixed in WordPress 6.0.18
6.1.15
Fixed in WordPress 6.1.16
6.1.14
Fixed in WordPress 6.1.16
6.1.13
Fixed in WordPress 6.1.16
6.1.12
Fixed in WordPress 6.1.16
6.1.11
Fixed in WordPress 6.1.16
6.1.10
Fixed in WordPress 6.1.16
6.1.9
Fixed in WordPress 6.1.16
6.1.8
Fixed in WordPress 6.1.16
6.1.7
Fixed in WordPress 6.1.16
6.1.6
Fixed in WordPress 6.1.16
6.1.5
Fixed in WordPress 6.1.16
6.1.4
Fixed in WordPress 6.1.16
6.1.3
Fixed in WordPress 6.1.16
6.1.2
Fixed in WordPress 6.1.16
6.1.1
Fixed in WordPress 6.1.16
6.1
Fixed in WordPress 6.1.16
6.2.14
Fixed in WordPress 6.2.15
6.2.13
Fixed in WordPress 6.2.15
6.2.12
Fixed in WordPress 6.2.15
6.2.11
Fixed in WordPress 6.2.15
6.2.10
Fixed in WordPress 6.2.15
6.2.9
Fixed in WordPress 6.2.15
6.2.8
Fixed in WordPress 6.2.15
6.2.7
Fixed in WordPress 6.2.15
6.2.6
Fixed in WordPress 6.2.15
6.2.5
Fixed in WordPress 6.2.15
6.2.4
Fixed in WordPress 6.2.15
6.2.3
Fixed in WordPress 6.2.15
6.2.2
Fixed in WordPress 6.2.15
6.2.1
Fixed in WordPress 6.2.15
6.2
Fixed in WordPress 6.2.15
6.3.13
Fixed in WordPress 6.3.14
6.3.12
Fixed in WordPress 6.3.14
6.3.11
Fixed in WordPress 6.3.14
6.3.10
Fixed in WordPress 6.3.14
6.3.9
Fixed in WordPress 6.3.14
6.3.8
Fixed in WordPress 6.3.14
6.3.7
Fixed in WordPress 6.3.14
6.3.6
Fixed in WordPress 6.3.14
6.3.5
Fixed in WordPress 6.3.14
6.3.4
Fixed in WordPress 6.3.14
6.3.3
Fixed in WordPress 6.3.14
6.3.2
Fixed in WordPress 6.3.14
6.3.1
Fixed in WordPress 6.3.14
6.3
Fixed in WordPress 6.3.14
6.4.13
Fixed in WordPress 6.4.14
6.4.12
Fixed in WordPress 6.4.14
6.4.11
Fixed in WordPress 6.4.14
6.4.10
Fixed in WordPress 6.4.14
6.4.9
Fixed in WordPress 6.4.14
6.4.8
Fixed in WordPress 6.4.14
6.4.7
Fixed in WordPress 6.4.14
6.4.6
Fixed in WordPress 6.4.14
6.4.5
Fixed in WordPress 6.4.14
6.4.4
Fixed in WordPress 6.4.14
6.4.3
Fixed in WordPress 6.4.14
6.4.2
Fixed in WordPress 6.4.14
6.4.1
Fixed in WordPress 6.4.14
6.4
Fixed in WordPress 6.4.14
6.5.13
Fixed in WordPress 6.5.14
6.5.12
Fixed in WordPress 6.5.14
6.5.11
Fixed in WordPress 6.5.14
6.5.10
Fixed in WordPress 6.5.14
6.5.9
Fixed in WordPress 6.5.14
6.5.8
Fixed in WordPress 6.5.14
6.5.7
Fixed in WordPress 6.5.14
6.5.6
Fixed in WordPress 6.5.14
6.5.5
Fixed in WordPress 6.5.14
6.5.4
Fixed in WordPress 6.5.14
6.5.3
Fixed in WordPress 6.5.14
6.5.2
Fixed in WordPress 6.5.14
6.5
Fixed in WordPress 6.5.14
6.6.10
Fixed in WordPress 6.6.11
6.6.9
Fixed in WordPress 6.6.11
6.6.8
Fixed in WordPress 6.6.11
6.6.7
Fixed in WordPress 6.6.11
6.6.6
Fixed in WordPress 6.6.11
6.6.5
Fixed in WordPress 6.6.11
6.6.4
Fixed in WordPress 6.6.11
6.6.3
Fixed in WordPress 6.6.11
6.6.2
Fixed in WordPress 6.6.11
6.6.1
Fixed in WordPress 6.6.11
6.6
Fixed in WordPress 6.6.11
6.7.10
Fixed in WordPress 6.7.11
6.7.9
Fixed in WordPress 6.7.11
6.7.8
Fixed in WordPress 6.7.11
6.7.7
Fixed in WordPress 6.7.11
6.7.6
Fixed in WordPress 6.7.11
6.7.5
Fixed in WordPress 6.7.11
6.7.4
Fixed in WordPress 6.7.11
6.7.3
Fixed in WordPress 6.7.11
6.7.2
Fixed in WordPress 6.7.11
6.7.1
Fixed in WordPress 6.7.11
6.7
Fixed in WordPress 6.7.11
6.8.11
Fixed in WordPress 6.8.12
6.8.10
Fixed in WordPress 6.8.12
6.8.9
Fixed in WordPress 6.8.12
6.8.8
Fixed in WordPress 6.8.12
6.8.7
Fixed in WordPress 6.8.12
6.8.6
Fixed in WordPress 6.8.12
6.8.5
Fixed in WordPress 6.8.12
6.8.4
Fixed in WordPress 6.8.12
6.8.3
Fixed in WordPress 6.8.12
6.8.2
Fixed in WordPress 6.8.12
6.8.1
Fixed in WordPress 6.8.12
6.8
Fixed in WordPress 6.8.12
6.9.10
Fixed in WordPress 6.9.11
6.9.9
Fixed in WordPress 6.9.11
6.9.8
Fixed in WordPress 6.9.11
6.9.7
Fixed in WordPress 6.9.11
6.9.6
Fixed in WordPress 6.9.11
6.9.5
Fixed in WordPress 6.9.11
6.9.4
Fixed in WordPress 6.9.11
6.9.3
Fixed in WordPress 6.9.11
6.9.2
Fixed in WordPress 6.9.11
6.9.1
Fixed in WordPress 6.9.11
6.9
Fixed in WordPress 6.9.11
7.0.7
Fixed in WordPress 7.0.8
7.0.6
Fixed in WordPress 7.0.8
7.0.5
Fixed in WordPress 7.0.8
7.0.4
Fixed in WordPress 7.0.8
7.0.3
Fixed in WordPress 7.0.8
7.0.2
Fixed in WordPress 7.0.8
7.0.1
Fixed in WordPress 7.0.8
7.0
Fixed in WordPress 7.0.8
7.1.3
Fixed in WordPress 7.1.4
7.1.2
Fixed in WordPress 7.1.4
7.1.1
Fixed in WordPress 7.1.4
7.1
Fixed in WordPress 7.1.4

Affects Plugins

Plugin icon
gutenberg
Fixed in 24.3.0

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-4/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Alex Concha
Verified
Yes
WPVDB ID
3d9893bd-9135-446f-9aff-99e88485ca21

Timeline

Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 17 hours ago)
Last Updated
2026-10-29 (about 17 hours ago)

Other

Published
Title
Published
2025-01-03
Title
Distance Based Shipping Calculator < 2.0.22 - Reflected Cross-Site Scripting
Published
2019-09-05
Title
WordPress 5.2.2 - Authenticated Cross-Site Scripting (XSS) in Post Previews
Published
2023-08-28
Title
GuruWalk Affiliates <= 1.0.0 - Admin+ Stored XSS
Published
2026-08-31
Title
Affiliate Super Assistent < 1.10.3 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function
Published
2026-10-26
Title
All In One Lightbox – show any media in beautiful popups < 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting