WordPress Vulnerabilities

WP 5.9 - 7.1.3 - Contributor+ Stored XSS via Comments Pagination Previous Block

Description

WordPress does not escape a block attribute in a comments pagination block in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks against site visitors. This also affects the Gutenberg plugin.

Affects WordPress

5.9.19
Fixed in WordPress 5.9.20
5.9.18
Fixed in WordPress 5.9.20
5.9.17
Fixed in WordPress 5.9.20
5.9.16
Fixed in WordPress 5.9.20
5.9.15
Fixed in WordPress 5.9.20
5.9.14
Fixed in WordPress 5.9.20
5.9.13
Fixed in WordPress 5.9.20
5.9.12
Fixed in WordPress 5.9.20
5.9.11
Fixed in WordPress 5.9.20
5.9.10
Fixed in WordPress 5.9.20
5.9.9
Fixed in WordPress 5.9.20
5.9.8
Fixed in WordPress 5.9.20
5.9.7
Fixed in WordPress 5.9.20
5.9.6
Fixed in WordPress 5.9.20
5.9.5
Fixed in WordPress 5.9.20
5.9.4
Fixed in WordPress 5.9.20
5.9.3
Fixed in WordPress 5.9.20
5.9.2
Fixed in WordPress 5.9.20
5.9.1
Fixed in WordPress 5.9.20
5.9
Fixed in WordPress 5.9.20
6.0.17
Fixed in WordPress 6.0.18
6.0.16
Fixed in WordPress 6.0.18
6.0.15
Fixed in WordPress 6.0.18
6.0.14
Fixed in WordPress 6.0.18
6.0.13
Fixed in WordPress 6.0.18
6.0.12
Fixed in WordPress 6.0.18
6.0.11
Fixed in WordPress 6.0.18
6.0.10
Fixed in WordPress 6.0.18
6.0.9
Fixed in WordPress 6.0.18
6.0.8
Fixed in WordPress 6.0.18
6.0.7
Fixed in WordPress 6.0.18
6.0.6
Fixed in WordPress 6.0.18
6.0.5
Fixed in WordPress 6.0.18
6.0.4
Fixed in WordPress 6.0.18
6.0.3
Fixed in WordPress 6.0.18
6.0.2
Fixed in WordPress 6.0.18
6.0.1
Fixed in WordPress 6.0.18
6.0
Fixed in WordPress 6.0.18
6.1.15
Fixed in WordPress 6.1.16
6.1.14
Fixed in WordPress 6.1.16
6.1.13
Fixed in WordPress 6.1.16
6.1.12
Fixed in WordPress 6.1.16
6.1.11
Fixed in WordPress 6.1.16
6.1.10
Fixed in WordPress 6.1.16
6.1.9
Fixed in WordPress 6.1.16
6.1.8
Fixed in WordPress 6.1.16
6.1.7
Fixed in WordPress 6.1.16
6.1.6
Fixed in WordPress 6.1.16
6.1.5
Fixed in WordPress 6.1.16
6.1.4
Fixed in WordPress 6.1.16
6.1.3
Fixed in WordPress 6.1.16
6.1.2
Fixed in WordPress 6.1.16
6.1.1
Fixed in WordPress 6.1.16
6.1
Fixed in WordPress 6.1.16
6.2.14
Fixed in WordPress 6.2.15
6.2.13
Fixed in WordPress 6.2.15
6.2.12
Fixed in WordPress 6.2.15
6.2.11
Fixed in WordPress 6.2.15
6.2.10
Fixed in WordPress 6.2.15
6.2.9
Fixed in WordPress 6.2.15
6.2.8
Fixed in WordPress 6.2.15
6.2.7
Fixed in WordPress 6.2.15
6.2.6
Fixed in WordPress 6.2.15
6.2.5
Fixed in WordPress 6.2.15
6.2.4
Fixed in WordPress 6.2.15
6.2.3
Fixed in WordPress 6.2.15
6.2.2
Fixed in WordPress 6.2.15
6.2.1
Fixed in WordPress 6.2.15
6.2
Fixed in WordPress 6.2.15
6.3.13
Fixed in WordPress 6.3.14
6.3.12
Fixed in WordPress 6.3.14
6.3.11
Fixed in WordPress 6.3.14
6.3.10
Fixed in WordPress 6.3.14
6.3.9
Fixed in WordPress 6.3.14
6.3.8
Fixed in WordPress 6.3.14
6.3.7
Fixed in WordPress 6.3.14
6.3.6
Fixed in WordPress 6.3.14
6.3.5
Fixed in WordPress 6.3.14
6.3.4
Fixed in WordPress 6.3.14
6.3.3
Fixed in WordPress 6.3.14
6.3.2
Fixed in WordPress 6.3.14
6.3.1
Fixed in WordPress 6.3.14
6.3
Fixed in WordPress 6.3.14
6.4.13
Fixed in WordPress 6.4.14
6.4.12
Fixed in WordPress 6.4.14
6.4.11
Fixed in WordPress 6.4.14
6.4.10
Fixed in WordPress 6.4.14
6.4.9
Fixed in WordPress 6.4.14
6.4.8
Fixed in WordPress 6.4.14
6.4.7
Fixed in WordPress 6.4.14
6.4.6
Fixed in WordPress 6.4.14
6.4.5
Fixed in WordPress 6.4.14
6.4.4
Fixed in WordPress 6.4.14
6.4.3
Fixed in WordPress 6.4.14
6.4.2
Fixed in WordPress 6.4.14
6.4.1
Fixed in WordPress 6.4.14
6.4
Fixed in WordPress 6.4.14
6.5.13
Fixed in WordPress 6.5.14
6.5.12
Fixed in WordPress 6.5.14
6.5.11
Fixed in WordPress 6.5.14
6.5.10
Fixed in WordPress 6.5.14
6.5.9
Fixed in WordPress 6.5.14
6.5.8
Fixed in WordPress 6.5.14
6.5.7
Fixed in WordPress 6.5.14
6.5.6
Fixed in WordPress 6.5.14
6.5.5
Fixed in WordPress 6.5.14
6.5.4
Fixed in WordPress 6.5.14
6.5.3
Fixed in WordPress 6.5.14
6.5.2
Fixed in WordPress 6.5.14
6.5
Fixed in WordPress 6.5.14
6.6.10
Fixed in WordPress 6.6.11
6.6.9
Fixed in WordPress 6.6.11
6.6.8
Fixed in WordPress 6.6.11
6.6.7
Fixed in WordPress 6.6.11
6.6.6
Fixed in WordPress 6.6.11
6.6.5
Fixed in WordPress 6.6.11
6.6.4
Fixed in WordPress 6.6.11
6.6.3
Fixed in WordPress 6.6.11
6.6.2
Fixed in WordPress 6.6.11
6.6.1
Fixed in WordPress 6.6.11
6.6
Fixed in WordPress 6.6.11
6.7.10
Fixed in WordPress 6.7.11
6.7.9
Fixed in WordPress 6.7.11
6.7.8
Fixed in WordPress 6.7.11
6.7.7
Fixed in WordPress 6.7.11
6.7.6
Fixed in WordPress 6.7.11
6.7.5
Fixed in WordPress 6.7.11
6.7.4
Fixed in WordPress 6.7.11
6.7.3
Fixed in WordPress 6.7.11
6.7.2
Fixed in WordPress 6.7.11
6.7.1
Fixed in WordPress 6.7.11
6.7
Fixed in WordPress 6.7.11
6.8.11
Fixed in WordPress 6.8.12
6.8.10
Fixed in WordPress 6.8.12
6.8.9
Fixed in WordPress 6.8.12
6.8.8
Fixed in WordPress 6.8.12
6.8.7
Fixed in WordPress 6.8.12
6.8.6
Fixed in WordPress 6.8.12
6.8.5
Fixed in WordPress 6.8.12
6.8.4
Fixed in WordPress 6.8.12
6.8.3
Fixed in WordPress 6.8.12
6.8.2
Fixed in WordPress 6.8.12
6.8.1
Fixed in WordPress 6.8.12
6.8
Fixed in WordPress 6.8.12
6.9.10
Fixed in WordPress 6.9.11
6.9.9
Fixed in WordPress 6.9.11
6.9.8
Fixed in WordPress 6.9.11
6.9.7
Fixed in WordPress 6.9.11
6.9.6
Fixed in WordPress 6.9.11
6.9.5
Fixed in WordPress 6.9.11
6.9.4
Fixed in WordPress 6.9.11
6.9.3
Fixed in WordPress 6.9.11
6.9.2
Fixed in WordPress 6.9.11
6.9.1
Fixed in WordPress 6.9.11
6.9
Fixed in WordPress 6.9.11
7.0.7
Fixed in WordPress 7.0.8
7.0.6
Fixed in WordPress 7.0.8
7.0.5
Fixed in WordPress 7.0.8
7.0.4
Fixed in WordPress 7.0.8
7.0.3
Fixed in WordPress 7.0.8
7.0.2
Fixed in WordPress 7.0.8
7.0.1
Fixed in WordPress 7.0.8
7.0
Fixed in WordPress 7.0.8
7.1.3
Fixed in WordPress 7.1.4
7.1.2
Fixed in WordPress 7.1.4
7.1.1
Fixed in WordPress 7.1.4
7.1
Fixed in WordPress 7.1.4

Affects Plugins

Plugin icon
gutenberg
Fixed in 24.3.0

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-4/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Alex Concha
Verified
Yes
WPVDB ID
47f54cc8-e7ee-4cac-8a56-dc5f3fc18ffa

Timeline

Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 17 hours ago)
Last Updated
2026-10-29 (about 17 hours ago)

Other

Published
Title
Published
2014-08-01
Title
Google reCAPTCHA <= 3.1.3 - Reflected XSS
Published
2023-11-29
Title
Innovs HR <= 1.0.3.4 - Reflected Cross-Site Scripting
Published
2021-11-29
Title
WP Remote < 4.65 - Reflected Cross-Site Scripting
Published
2025-04-16
Title
Uix Shortcodes < 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-12-05
Title
Bold Page Builder < 4.7.0 - Contributor+ Stored XSS