WordPress Vulnerabilities

WP < 7.0.3 - Contributor+ Stored XSS in Quick Edits

Description

WordPress does not properly escape user display names in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the affected admin screens.

Affects WordPress

7.0.2
Fixed in WordPress 7.0.3
7.0.1
Fixed in WordPress 7.0.3
7.0
Fixed in WordPress 7.0.3
6.9.5
Fixed in WordPress 6.9.6
6.9.4
Fixed in WordPress 6.9.6
6.9.3
Fixed in WordPress 6.9.6
6.9.2
Fixed in WordPress 6.9.6
6.9.1
Fixed in WordPress 6.9.6
6.9
Fixed in WordPress 6.9.6
6.8.6
Fixed in WordPress 6.8.7
6.8.5
Fixed in WordPress 6.8.7
6.8.4
Fixed in WordPress 6.8.7
6.8.3
Fixed in WordPress 6.8.7
6.8.2
Fixed in WordPress 6.8.7
6.8.1
Fixed in WordPress 6.8.7
6.8
Fixed in WordPress 6.8.7
6.7.5
Fixed in WordPress 6.7.6
6.7.4
Fixed in WordPress 6.7.6
6.7.3
Fixed in WordPress 6.7.6
6.7.2
Fixed in WordPress 6.7.6
6.7.1
Fixed in WordPress 6.7.6
6.7
Fixed in WordPress 6.7.6
6.6.5
Fixed in WordPress 6.6.6
6.6.4
Fixed in WordPress 6.6.6
6.6.3
Fixed in WordPress 6.6.6
6.6.2
Fixed in WordPress 6.6.6
6.6.1
Fixed in WordPress 6.6.6
6.6
Fixed in WordPress 6.6.6
6.5.8
Fixed in WordPress 6.5.9
6.5.7
Fixed in WordPress 6.5.9
6.5.6
Fixed in WordPress 6.5.9
6.5.5
Fixed in WordPress 6.5.9
6.5.4
Fixed in WordPress 6.5.9
6.5.3
Fixed in WordPress 6.5.9
6.5.2
Fixed in WordPress 6.5.9
6.5
Fixed in WordPress 6.5.9
6.4.8
Fixed in WordPress 6.4.9
6.4.7
Fixed in WordPress 6.4.9
6.4.6
Fixed in WordPress 6.4.9
6.4.5
Fixed in WordPress 6.4.9
6.4.4
Fixed in WordPress 6.4.9
6.4.3
Fixed in WordPress 6.4.9
6.4.2
Fixed in WordPress 6.4.9
6.4.1
Fixed in WordPress 6.4.9
6.4
Fixed in WordPress 6.4.9
6.3.8
Fixed in WordPress 6.3.9
6.3.7
Fixed in WordPress 6.3.9
6.3.6
Fixed in WordPress 6.3.9
6.3.5
Fixed in WordPress 6.3.9
6.3.4
Fixed in WordPress 6.3.9
6.3.3
Fixed in WordPress 6.3.9
6.3.2
Fixed in WordPress 6.3.9
6.3.1
Fixed in WordPress 6.3.9
6.3
Fixed in WordPress 6.3.9
6.2.9
Fixed in WordPress 6.2.10
6.2.8
Fixed in WordPress 6.2.10
6.2.7
Fixed in WordPress 6.2.10
6.2.6
Fixed in WordPress 6.2.10
6.2.5
Fixed in WordPress 6.2.10
6.2.4
Fixed in WordPress 6.2.10
6.2.3
Fixed in WordPress 6.2.10
6.2.2
Fixed in WordPress 6.2.10
6.2.1
Fixed in WordPress 6.2.10
6.2
Fixed in WordPress 6.2.10
6.1.10
Fixed in WordPress 7.0.3
6.1.9
Fixed in WordPress 7.0.3
6.1.8
Fixed in WordPress 7.0.3
6.1.7
Fixed in WordPress 7.0.3
6.1.6
Fixed in WordPress 7.0.3
6.1.5
Fixed in WordPress 7.0.3
6.1.4
Fixed in WordPress 7.0.3
6.1.3
Fixed in WordPress 7.0.3
6.1.2
Fixed in WordPress 7.0.3
6.1.1
Fixed in WordPress 7.0.3
6.1
Fixed in WordPress 7.0.3
6.0.12
Fixed in WordPress 7.0.3
6.0.11
Fixed in WordPress 7.0.3
6.0.10
Fixed in WordPress 7.0.3
6.0.9
Fixed in WordPress 7.0.3
6.0.8
Fixed in WordPress 7.0.3
6.0.7
Fixed in WordPress 7.0.3
6.0.6
Fixed in WordPress 7.0.3
6.0.5
Fixed in WordPress 7.0.3
6.0.4
Fixed in WordPress 7.0.3
6.0.3
Fixed in WordPress 7.0.3
6.0.2
Fixed in WordPress 7.0.3
6.0.1
Fixed in WordPress 7.0.3
6.0
Fixed in WordPress 7.0.3
5.9.13
Fixed in WordPress 7.0.3
5.9.12
Fixed in WordPress 7.0.3
5.9.11
Fixed in WordPress 7.0.3
5.9.10
Fixed in WordPress 7.0.3
5.9.9
Fixed in WordPress 7.0.3
5.9.8
Fixed in WordPress 7.0.3
5.9.7
Fixed in WordPress 7.0.3
5.9.6
Fixed in WordPress 7.0.3
5.9.5
Fixed in WordPress 7.0.3
5.9.4
Fixed in WordPress 7.0.3
5.9.3
Fixed in WordPress 7.0.3
5.9.2
Fixed in WordPress 7.0.3
5.9.1
Fixed in WordPress 7.0.3
5.9
Fixed in WordPress 7.0.3
5.8.13
Fixed in WordPress 7.0.3
5.8.12
Fixed in WordPress 7.0.3
5.8.11
Fixed in WordPress 7.0.3
5.8.10
Fixed in WordPress 7.0.3
5.8.9
Fixed in WordPress 7.0.3
5.8.8
Fixed in WordPress 7.0.3
5.8.7
Fixed in WordPress 7.0.3
5.8.6
Fixed in WordPress 7.0.3
5.8.5
Fixed in WordPress 7.0.3
5.8.4
Fixed in WordPress 7.0.3
5.8.3
Fixed in WordPress 7.0.3
5.8.2
Fixed in WordPress 7.0.3
5.8.1
Fixed in WordPress 7.0.3
5.8
Fixed in WordPress 7.0.3
5.7.15
Fixed in WordPress 7.0.3
5.7.14
Fixed in WordPress 7.0.3
5.7.13
Fixed in WordPress 7.0.3
5.7.12
Fixed in WordPress 7.0.3
5.7.11
Fixed in WordPress 7.0.3
5.7.10
Fixed in WordPress 7.0.3
5.7.9
Fixed in WordPress 7.0.3
5.7.8
Fixed in WordPress 7.0.3
5.7.7
Fixed in WordPress 7.0.3
5.7.6
Fixed in WordPress 7.0.3
5.7.5
Fixed in WordPress 7.0.3
5.7.4
Fixed in WordPress 7.0.3
5.7.3
Fixed in WordPress 7.0.3
5.7.2
Fixed in WordPress 7.0.3
5.7.1
Fixed in WordPress 7.0.3
5.7
Fixed in WordPress 7.0.3
5.6.17
Fixed in WordPress 7.0.3
5.6.16
Fixed in WordPress 7.0.3
5.6.15
Fixed in WordPress 7.0.3
5.6.14
Fixed in WordPress 7.0.3
5.6.13
Fixed in WordPress 7.0.3
5.6.12
Fixed in WordPress 7.0.3
5.6.11
Fixed in WordPress 7.0.3
5.6.10
Fixed in WordPress 7.0.3
5.6.9
Fixed in WordPress 7.0.3
5.6.8
Fixed in WordPress 7.0.3
5.6.7
Fixed in WordPress 7.0.3
5.6.6
Fixed in WordPress 7.0.3
5.6.5
Fixed in WordPress 7.0.3
5.6.4
Fixed in WordPress 7.0.3
5.6.3
Fixed in WordPress 7.0.3
5.6.2
Fixed in WordPress 7.0.3
5.6.1
Fixed in WordPress 7.0.3
5.6
Fixed in WordPress 7.0.3
5.5.18
Fixed in WordPress 7.0.3
5.5.17
Fixed in WordPress 7.0.3
5.5.16
Fixed in WordPress 7.0.3
5.5.15
Fixed in WordPress 7.0.3
5.5.14
Fixed in WordPress 7.0.3
5.5.13
Fixed in WordPress 7.0.3
5.5.12
Fixed in WordPress 7.0.3
5.5.11
Fixed in WordPress 7.0.3
5.5.10
Fixed in WordPress 7.0.3
5.5.9
Fixed in WordPress 7.0.3
5.5.8
Fixed in WordPress 7.0.3
5.5.7
Fixed in WordPress 7.0.3
5.5.6
Fixed in WordPress 7.0.3
5.5.5
Fixed in WordPress 7.0.3
5.5.4
Fixed in WordPress 7.0.3
5.5.3
Fixed in WordPress 7.0.3
5.5.2
Fixed in WordPress 7.0.3
5.5.1
Fixed in WordPress 7.0.3
5.5
Fixed in WordPress 7.0.3
5.4.19
Fixed in WordPress 7.0.3
5.4.18
Fixed in WordPress 7.0.3
5.4.17
Fixed in WordPress 7.0.3
5.4.16
Fixed in WordPress 7.0.3
5.4.15
Fixed in WordPress 7.0.3
5.4.14
Fixed in WordPress 7.0.3
5.4.13
Fixed in WordPress 7.0.3
5.4.12
Fixed in WordPress 7.0.3
5.4.11
Fixed in WordPress 7.0.3
5.4.10
Fixed in WordPress 7.0.3
5.4.9
Fixed in WordPress 7.0.3
5.4.8
Fixed in WordPress 7.0.3
5.4.7
Fixed in WordPress 7.0.3
5.4.6
Fixed in WordPress 7.0.3
5.4.5
Fixed in WordPress 7.0.3
5.4.4
Fixed in WordPress 7.0.3
5.4.3
Fixed in WordPress 7.0.3
5.4.2
Fixed in WordPress 7.0.3
5.4.1
Fixed in WordPress 7.0.3
5.4
Fixed in WordPress 7.0.3
5.3.21
Fixed in WordPress 7.0.3
5.3.20
Fixed in WordPress 7.0.3
5.3.19
Fixed in WordPress 7.0.3
5.3.18
Fixed in WordPress 7.0.3
5.3.17
Fixed in WordPress 7.0.3
5.3.16
Fixed in WordPress 7.0.3
5.3.15
Fixed in WordPress 7.0.3
5.3.14
Fixed in WordPress 7.0.3
5.3.13
Fixed in WordPress 7.0.3
5.3.12
Fixed in WordPress 7.0.3
5.3.11
Fixed in WordPress 7.0.3
5.3.10
Fixed in WordPress 7.0.3
5.3.9
Fixed in WordPress 7.0.3
5.3.8
Fixed in WordPress 7.0.3
5.3.7
Fixed in WordPress 7.0.3
5.3.6
Fixed in WordPress 7.0.3
5.3.5
Fixed in WordPress 7.0.3
5.3.4
Fixed in WordPress 7.0.3
5.3.3
Fixed in WordPress 7.0.3
5.3.2
Fixed in WordPress 7.0.3
5.3.1
Fixed in WordPress 7.0.3
5.3
Fixed in WordPress 7.0.3
5.2.24
Fixed in WordPress 7.0.3
5.2.23
Fixed in WordPress 7.0.3
5.2.22
Fixed in WordPress 7.0.3
5.2.21
Fixed in WordPress 7.0.3
5.2.20
Fixed in WordPress 7.0.3
5.2.19
Fixed in WordPress 7.0.3
5.2.18
Fixed in WordPress 7.0.3
5.2.17
Fixed in WordPress 7.0.3
5.2.16
Fixed in WordPress 7.0.3
5.2.15
Fixed in WordPress 7.0.3
5.2.14
Fixed in WordPress 7.0.3
5.2.13
Fixed in WordPress 7.0.3
5.2.12
Fixed in WordPress 7.0.3
5.2.11
Fixed in WordPress 7.0.3
5.2.10
Fixed in WordPress 7.0.3
5.2.9
Fixed in WordPress 7.0.3
5.2.8
Fixed in WordPress 7.0.3
5.2.7
Fixed in WordPress 7.0.3
5.2.6
Fixed in WordPress 7.0.3
5.2.5
Fixed in WordPress 7.0.3
5.2.4
Fixed in WordPress 7.0.3
5.2.3
Fixed in WordPress 7.0.3
5.2.2
Fixed in WordPress 7.0.3
5.2.1
Fixed in WordPress 7.0.3
5.2
Fixed in WordPress 7.0.3
5.1.22
Fixed in WordPress 7.0.3
5.1.21
Fixed in WordPress 7.0.3
5.1.20
Fixed in WordPress 7.0.3
5.1.19
Fixed in WordPress 7.0.3
5.1.18
Fixed in WordPress 7.0.3
5.1.17
Fixed in WordPress 7.0.3
5.1.16
Fixed in WordPress 7.0.3
5.1.15
Fixed in WordPress 7.0.3
5.1.14
Fixed in WordPress 7.0.3
5.1.13
Fixed in WordPress 7.0.3
5.1.12
Fixed in WordPress 7.0.3
5.1.11
Fixed in WordPress 7.0.3
5.1.10
Fixed in WordPress 7.0.3
5.1.9
Fixed in WordPress 7.0.3
5.1.8
Fixed in WordPress 7.0.3
5.1.7
Fixed in WordPress 7.0.3
5.1.6
Fixed in WordPress 7.0.3
5.1.5
Fixed in WordPress 7.0.3
5.1.4
Fixed in WordPress 7.0.3
5.1.3
Fixed in WordPress 7.0.3
5.1.2
Fixed in WordPress 7.0.3
5.1.1
Fixed in WordPress 7.0.3
5.1
Fixed in WordPress 7.0.3
5.0.25
Fixed in WordPress 7.0.3
5.0.24
Fixed in WordPress 7.0.3
5.0.23
Fixed in WordPress 7.0.3
5.0.22
Fixed in WordPress 7.0.3
5.0.21
Fixed in WordPress 7.0.3
5.0.20
Fixed in WordPress 7.0.3
5.0.19
Fixed in WordPress 7.0.3
5.0.18
Fixed in WordPress 7.0.3
5.0.17
Fixed in WordPress 7.0.3
5.0.16
Fixed in WordPress 7.0.3
5.0.15
Fixed in WordPress 7.0.3
5.0.14
Fixed in WordPress 7.0.3
5.0.13
Fixed in WordPress 7.0.3
5.0.12
Fixed in WordPress 7.0.3
5.0.11
Fixed in WordPress 7.0.3
5.0.10
Fixed in WordPress 7.0.3
5.0.9
Fixed in WordPress 7.0.3
5.0.8
Fixed in WordPress 7.0.3
5.0.7
Fixed in WordPress 7.0.3
5.0.6
Fixed in WordPress 7.0.3
5.0.4
Fixed in WordPress 7.0.3
5.0.3
Fixed in WordPress 7.0.3
5.0.2
Fixed in WordPress 7.0.3
5.0.1
Fixed in WordPress 7.0.3
5.0
Fixed in WordPress 7.0.3
4.9.29
Fixed in WordPress 7.0.3
4.9.28
Fixed in WordPress 7.0.3
4.9.27
Fixed in WordPress 7.0.3
4.9.26
Fixed in WordPress 7.0.3
4.9.25
Fixed in WordPress 7.0.3
4.9.24
Fixed in WordPress 7.0.3
4.9.23
Fixed in WordPress 7.0.3
4.9.22
Fixed in WordPress 7.0.3
4.9.21
Fixed in WordPress 7.0.3
4.9.20
Fixed in WordPress 7.0.3
4.9.19
Fixed in WordPress 7.0.3
4.9.18
Fixed in WordPress 7.0.3
4.9.17
Fixed in WordPress 7.0.3
4.9.16
Fixed in WordPress 7.0.3
4.9.15
Fixed in WordPress 7.0.3
4.9.14
Fixed in WordPress 7.0.3
4.9.13
Fixed in WordPress 7.0.3
4.9.12
Fixed in WordPress 7.0.3
4.9.11
Fixed in WordPress 7.0.3
4.9.10
Fixed in WordPress 7.0.3
4.9.9
Fixed in WordPress 7.0.3
4.9.8
Fixed in WordPress 7.0.3
4.9.7
Fixed in WordPress 7.0.3
4.9.6
Fixed in WordPress 7.0.3
4.9.5
Fixed in WordPress 7.0.3
4.9.4
Fixed in WordPress 7.0.3
4.9.3
Fixed in WordPress 7.0.3
4.9.2
Fixed in WordPress 7.0.3
4.9.1
Fixed in WordPress 7.0.3
4.9
Fixed in WordPress 7.0.3
4.8.28
Fixed in WordPress 7.0.3
4.8.27
Fixed in WordPress 7.0.3
4.8.26
Fixed in WordPress 7.0.3
4.8.25
Fixed in WordPress 7.0.3
4.8.24
Fixed in WordPress 7.0.3
4.8.23
Fixed in WordPress 7.0.3
4.8.22
Fixed in WordPress 7.0.3
4.8.21
Fixed in WordPress 7.0.3
4.8.20
Fixed in WordPress 7.0.3
4.8.19
Fixed in WordPress 7.0.3
4.8.18
Fixed in WordPress 7.0.3
4.8.17
Fixed in WordPress 7.0.3
4.8.16
Fixed in WordPress 7.0.3
4.8.15
Fixed in WordPress 7.0.3
4.8.14
Fixed in WordPress 7.0.3
4.8.13
Fixed in WordPress 7.0.3
4.8.12
Fixed in WordPress 7.0.3
4.8.11
Fixed in WordPress 7.0.3
4.8.10
Fixed in WordPress 7.0.3
4.8.9
Fixed in WordPress 7.0.3
4.8.8
Fixed in WordPress 7.0.3
4.8.7
Fixed in WordPress 7.0.3
4.8.6
Fixed in WordPress 7.0.3
4.8.5
Fixed in WordPress 7.0.3
4.8.4
Fixed in WordPress 7.0.3
4.8.3
Fixed in WordPress 7.0.3
4.8.2
Fixed in WordPress 7.0.3
4.8.1
Fixed in WordPress 7.0.3
4.8
Fixed in WordPress 7.0.3
4.7.33
Fixed in WordPress 7.0.3
4.7.32
Fixed in WordPress 7.0.3
4.7.31
Fixed in WordPress 7.0.3
4.7.30
Fixed in WordPress 7.0.3
4.7.29
Fixed in WordPress 7.0.3
4.7.28
Fixed in WordPress 7.0.3
4.7.27
Fixed in WordPress 7.0.3
4.7.26
Fixed in WordPress 7.0.3
4.7.25
Fixed in WordPress 7.0.3
4.7.24
Fixed in WordPress 7.0.3
4.7.23
Fixed in WordPress 7.0.3
4.7.22
Fixed in WordPress 7.0.3
4.7.21
Fixed in WordPress 7.0.3
4.7.20
Fixed in WordPress 7.0.3
4.7.19
Fixed in WordPress 7.0.3
4.7.18
Fixed in WordPress 7.0.3
4.7.17
Fixed in WordPress 7.0.3
4.7.16
Fixed in WordPress 7.0.3
4.7.15
Fixed in WordPress 7.0.3
4.7.14
Fixed in WordPress 7.0.3
4.7.13
Fixed in WordPress 7.0.3
4.7.12
Fixed in WordPress 7.0.3
4.7.11
Fixed in WordPress 7.0.3
4.7.10
Fixed in WordPress 7.0.3
4.7.9
Fixed in WordPress 7.0.3
4.7.8
Fixed in WordPress 7.0.3
4.7.7
Fixed in WordPress 7.0.3
4.7.6
Fixed in WordPress 7.0.3
4.7.5
Fixed in WordPress 7.0.3
4.7.4
Fixed in WordPress 7.0.3
4.7.3
Fixed in WordPress 7.0.3
4.7.2
Fixed in WordPress 7.0.3
4.7.1
Fixed in WordPress 7.0.3
4.7
Fixed in WordPress 7.0.3

References

URL
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Naveen S and Ajmal Moochingal
Verified
Yes
WPVDB ID
72b68d3f-77a0-47dd-9624-e3631409a352

Timeline

Publicly Published
2026-08-06 (about 1 month ago)
Added
2026-08-06 (about 1 month ago)
Last Updated
2026-08-06 (about 1 month ago)

Other

Published
Title
Published
2025-02-27
Title
MK Google Directions < 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-03-06
Title
Hammas Calendar < 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute
Published
2024-05-20
Title
Elementor Website Builder < 3.21.6 - Contributor+ DOM Stored XSS
Published
2025-04-29
Title
BP Messages Tool < 2.5 - Reflected Cross-Site Scripting
Published
2024-11-08
Title
Moka Get Posts Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting