WordPress Vulnerabilities
WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Context Namespace Pollution
Description
WordPress does not correctly isolate Interactivity API context data in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session when the content is previewed. This also affects the Gutenberg plugin.
Affects WordPress
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.5.14
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.6.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.1.4
Fixed in WordPress 7.1.4
Fixed in WordPress 7.1.4
Fixed in WordPress 7.1.4 Affects Plugins
Fixed in 24.3.0 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
rekter0
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 17 hours ago)
Last Updated
2026-10-29 (about 17 hours ago)
