WordPress Vulnerabilities

WP < 7.1.1 - Unauthenticated Stored XSS via Comments

Description

WordPress does not properly sanitise and format comment content in some cases, which could allow unauthenticated visitors to perform Stored XSS attacks against anyone viewing the post once the comment is approved.

Affects WordPress

7.1
Fixed in WordPress 7.1.1
7.0.4
Fixed in WordPress 7.0.5
7.0.3
Fixed in WordPress 7.0.5
7.0.2
Fixed in WordPress 7.0.5
7.0.1
Fixed in WordPress 7.0.5
7.0
Fixed in WordPress 7.0.5
6.9.7
Fixed in WordPress 6.9.8
6.9.6
Fixed in WordPress 6.9.8
6.9.5
Fixed in WordPress 6.9.8
6.9.4
Fixed in WordPress 6.9.8
6.9.3
Fixed in WordPress 6.9.8
6.9.2
Fixed in WordPress 6.9.8
6.9.1
Fixed in WordPress 6.9.8
6.9
Fixed in WordPress 6.9.8
6.8.8
Fixed in WordPress 6.8.9
6.8.7
Fixed in WordPress 6.8.9
6.8.6
Fixed in WordPress 6.8.9
6.8.5
Fixed in WordPress 6.8.9
6.8.4
Fixed in WordPress 6.8.9
6.8.3
Fixed in WordPress 6.8.9
6.8.2
Fixed in WordPress 6.8.9
6.8.1
Fixed in WordPress 6.8.9
6.8
Fixed in WordPress 6.8.9
6.7.7
Fixed in WordPress 6.7.8
6.7.6
Fixed in WordPress 6.7.8
6.7.5
Fixed in WordPress 6.7.8
6.7.4
Fixed in WordPress 6.7.8
6.7.3
Fixed in WordPress 6.7.8
6.7.2
Fixed in WordPress 6.7.8
6.7.1
Fixed in WordPress 6.7.8
6.7
Fixed in WordPress 6.7.8
6.6.7
Fixed in WordPress 6.6.8
6.6.6
Fixed in WordPress 6.6.8
6.6.5
Fixed in WordPress 6.6.8
6.6.4
Fixed in WordPress 6.6.8
6.6.3
Fixed in WordPress 6.6.8
6.6.2
Fixed in WordPress 6.6.8
6.6.1
Fixed in WordPress 6.6.8
6.6
Fixed in WordPress 6.6.8
6.5.10
Fixed in WordPress 6.5.11
6.5.9
Fixed in WordPress 6.5.11
6.5.8
Fixed in WordPress 6.5.11
6.5.7
Fixed in WordPress 6.5.11
6.5.6
Fixed in WordPress 6.5.11
6.5.5
Fixed in WordPress 6.5.11
6.5.4
Fixed in WordPress 6.5.11
6.5.3
Fixed in WordPress 6.5.11
6.5.2
Fixed in WordPress 6.5.11
6.5
Fixed in WordPress 6.5.11
6.4.10
Fixed in WordPress 6.4.11
6.4.9
Fixed in WordPress 6.4.11
6.4.8
Fixed in WordPress 6.4.11
6.4.7
Fixed in WordPress 6.4.11
6.4.6
Fixed in WordPress 6.4.11
6.4.5
Fixed in WordPress 6.4.11
6.4.4
Fixed in WordPress 6.4.11
6.4.3
Fixed in WordPress 6.4.11
6.4.2
Fixed in WordPress 6.4.11
6.4.1
Fixed in WordPress 6.4.11
6.4
Fixed in WordPress 6.4.11
6.3.10
Fixed in WordPress 6.3.11
6.3.9
Fixed in WordPress 6.3.11
6.3.8
Fixed in WordPress 6.3.11
6.3.7
Fixed in WordPress 6.3.11
6.3.6
Fixed in WordPress 6.3.11
6.3.5
Fixed in WordPress 6.3.11
6.3.4
Fixed in WordPress 6.3.11
6.3.3
Fixed in WordPress 6.3.11
6.3.2
Fixed in WordPress 6.3.11
6.3.1
Fixed in WordPress 6.3.11
6.3
Fixed in WordPress 6.3.11
6.2.11
Fixed in WordPress 6.2.12
6.2.10
Fixed in WordPress 6.2.12
6.2.9
Fixed in WordPress 6.2.12
6.2.8
Fixed in WordPress 6.2.12
6.2.7
Fixed in WordPress 6.2.12
6.2.6
Fixed in WordPress 6.2.12
6.2.5
Fixed in WordPress 6.2.12
6.2.4
Fixed in WordPress 6.2.12
6.2.3
Fixed in WordPress 6.2.12
6.2.2
Fixed in WordPress 6.2.12
6.2.1
Fixed in WordPress 6.2.12
6.2
Fixed in WordPress 6.2.12
6.1.12
Fixed in WordPress 6.1.13
6.1.11
Fixed in WordPress 6.1.13
6.1.10
Fixed in WordPress 6.1.13
6.1.9
Fixed in WordPress 6.1.13
6.1.8
Fixed in WordPress 6.1.13
6.1.7
Fixed in WordPress 6.1.13
6.1.6
Fixed in WordPress 6.1.13
6.1.5
Fixed in WordPress 6.1.13
6.1.4
Fixed in WordPress 6.1.13
6.1.3
Fixed in WordPress 6.1.13
6.1.2
Fixed in WordPress 6.1.13
6.1.1
Fixed in WordPress 6.1.13
6.1
Fixed in WordPress 6.1.13
6.0.14
Fixed in WordPress 6.0.15
6.0.13
Fixed in WordPress 6.0.15
6.0.12
Fixed in WordPress 6.0.15
6.0.11
Fixed in WordPress 6.0.15
6.0.10
Fixed in WordPress 6.0.15
6.0.9
Fixed in WordPress 6.0.15
6.0.8
Fixed in WordPress 6.0.15
6.0.7
Fixed in WordPress 6.0.15
6.0.6
Fixed in WordPress 6.0.15
6.0.5
Fixed in WordPress 6.0.15
6.0.4
Fixed in WordPress 6.0.15
6.0.3
Fixed in WordPress 6.0.15
6.0.2
Fixed in WordPress 6.0.15
6.0.1
Fixed in WordPress 6.0.15
6.0
Fixed in WordPress 6.0.15
5.9.16
Fixed in WordPress 5.9.17
5.9.15
Fixed in WordPress 5.9.17
5.9.14
Fixed in WordPress 5.9.17
5.9.13
Fixed in WordPress 5.9.17
5.9.12
Fixed in WordPress 5.9.17
5.9.11
Fixed in WordPress 5.9.17
5.9.10
Fixed in WordPress 5.9.17
5.9.9
Fixed in WordPress 5.9.17
5.9.8
Fixed in WordPress 5.9.17
5.9.7
Fixed in WordPress 5.9.17
5.9.6
Fixed in WordPress 5.9.17
5.9.5
Fixed in WordPress 5.9.17
5.9.4
Fixed in WordPress 5.9.17
5.9.3
Fixed in WordPress 5.9.17
5.9.2
Fixed in WordPress 5.9.17
5.9.1
Fixed in WordPress 5.9.17
5.9
Fixed in WordPress 5.9.17
5.8.15
Fixed in WordPress 5.8.16
5.8.14
Fixed in WordPress 5.8.16
5.8.13
Fixed in WordPress 5.8.16
5.8.12
Fixed in WordPress 5.8.16
5.8.11
Fixed in WordPress 5.8.16
5.8.10
Fixed in WordPress 5.8.16
5.8.9
Fixed in WordPress 5.8.16
5.8.8
Fixed in WordPress 5.8.16
5.8.7
Fixed in WordPress 5.8.16
5.8.6
Fixed in WordPress 5.8.16
5.8.5
Fixed in WordPress 5.8.16
5.8.4
Fixed in WordPress 5.8.16
5.8.3
Fixed in WordPress 5.8.16
5.8.2
Fixed in WordPress 5.8.16
5.8.1
Fixed in WordPress 5.8.16
5.8
Fixed in WordPress 5.8.16
5.7.17
Fixed in WordPress 5.7.18
5.7.16
Fixed in WordPress 5.7.18
5.7.15
Fixed in WordPress 5.7.18
5.7.14
Fixed in WordPress 5.7.18
5.7.13
Fixed in WordPress 5.7.18
5.7.12
Fixed in WordPress 5.7.18
5.7.11
Fixed in WordPress 5.7.18
5.7.10
Fixed in WordPress 5.7.18
5.7.9
Fixed in WordPress 5.7.18
5.7.8
Fixed in WordPress 5.7.18
5.7.7
Fixed in WordPress 5.7.18
5.7.6
Fixed in WordPress 5.7.18
5.7.5
Fixed in WordPress 5.7.18
5.7.4
Fixed in WordPress 5.7.18
5.7.3
Fixed in WordPress 5.7.18
5.7.2
Fixed in WordPress 5.7.18
5.7.1
Fixed in WordPress 5.7.18
5.7
Fixed in WordPress 5.7.18
5.6.19
Fixed in WordPress 5.6.20
5.6.18
Fixed in WordPress 5.6.20
5.6.17
Fixed in WordPress 5.6.20
5.6.16
Fixed in WordPress 5.6.20
5.6.15
Fixed in WordPress 5.6.20
5.6.14
Fixed in WordPress 5.6.20
5.6.13
Fixed in WordPress 5.6.20
5.6.12
Fixed in WordPress 5.6.20
5.6.11
Fixed in WordPress 5.6.20
5.6.10
Fixed in WordPress 5.6.20
5.6.9
Fixed in WordPress 5.6.20
5.6.8
Fixed in WordPress 5.6.20
5.6.7
Fixed in WordPress 5.6.20
5.6.6
Fixed in WordPress 5.6.20
5.6.5
Fixed in WordPress 5.6.20
5.6.4
Fixed in WordPress 5.6.20
5.6.3
Fixed in WordPress 5.6.20
5.6.2
Fixed in WordPress 5.6.20
5.6.1
Fixed in WordPress 5.6.20
5.6
Fixed in WordPress 5.6.20
5.5.20
Fixed in WordPress 5.5.21
5.5.19
Fixed in WordPress 5.5.21
5.5.18
Fixed in WordPress 5.5.21
5.5.17
Fixed in WordPress 5.5.21
5.5.16
Fixed in WordPress 5.5.21
5.5.15
Fixed in WordPress 5.5.21
5.5.14
Fixed in WordPress 5.5.21
5.5.13
Fixed in WordPress 5.5.21
5.5.12
Fixed in WordPress 5.5.21
5.5.11
Fixed in WordPress 5.5.21
5.5.10
Fixed in WordPress 5.5.21
5.5.9
Fixed in WordPress 5.5.21
5.5.8
Fixed in WordPress 5.5.21
5.5.7
Fixed in WordPress 5.5.21
5.5.6
Fixed in WordPress 5.5.21
5.5.5
Fixed in WordPress 5.5.21
5.5.4
Fixed in WordPress 5.5.21
5.5.3
Fixed in WordPress 5.5.21
5.5.2
Fixed in WordPress 5.5.21
5.5.1
Fixed in WordPress 5.5.21
5.5
Fixed in WordPress 5.5.21
5.4.21
Fixed in WordPress 5.4.22
5.4.20
Fixed in WordPress 5.4.22
5.4.19
Fixed in WordPress 5.4.22
5.4.18
Fixed in WordPress 5.4.22
5.4.17
Fixed in WordPress 5.4.22
5.4.16
Fixed in WordPress 5.4.22
5.4.15
Fixed in WordPress 5.4.22
5.4.14
Fixed in WordPress 5.4.22
5.4.13
Fixed in WordPress 5.4.22
5.4.12
Fixed in WordPress 5.4.22
5.4.11
Fixed in WordPress 5.4.22
5.4.10
Fixed in WordPress 5.4.22
5.4.9
Fixed in WordPress 5.4.22
5.4.8
Fixed in WordPress 5.4.22
5.4.7
Fixed in WordPress 5.4.22
5.4.6
Fixed in WordPress 5.4.22
5.4.5
Fixed in WordPress 5.4.22
5.4.4
Fixed in WordPress 5.4.22
5.4.3
Fixed in WordPress 5.4.22
5.4.2
Fixed in WordPress 5.4.22
5.4.1
Fixed in WordPress 5.4.22
5.4
Fixed in WordPress 5.4.22
5.3.23
Fixed in WordPress 5.3.24
5.3.22
Fixed in WordPress 5.3.24
5.3.21
Fixed in WordPress 5.3.24
5.3.20
Fixed in WordPress 5.3.24
5.3.19
Fixed in WordPress 5.3.24
5.3.18
Fixed in WordPress 5.3.24
5.3.17
Fixed in WordPress 5.3.24
5.3.16
Fixed in WordPress 5.3.24
5.3.15
Fixed in WordPress 5.3.24
5.3.14
Fixed in WordPress 5.3.24
5.3.13
Fixed in WordPress 5.3.24
5.3.12
Fixed in WordPress 5.3.24
5.3.11
Fixed in WordPress 5.3.24
5.3.10
Fixed in WordPress 5.3.24
5.3.9
Fixed in WordPress 5.3.24
5.3.8
Fixed in WordPress 5.3.24
5.3.7
Fixed in WordPress 5.3.24
5.3.6
Fixed in WordPress 5.3.24
5.3.5
Fixed in WordPress 5.3.24
5.3.4
Fixed in WordPress 5.3.24
5.3.3
Fixed in WordPress 5.3.24
5.3.2
Fixed in WordPress 5.3.24
5.3.1
Fixed in WordPress 5.3.24
5.3
Fixed in WordPress 5.3.24
5.2.26
Fixed in WordPress 5.2.27
5.2.25
Fixed in WordPress 5.2.27
5.2.24
Fixed in WordPress 5.2.27
5.2.23
Fixed in WordPress 5.2.27
5.2.22
Fixed in WordPress 5.2.27
5.2.21
Fixed in WordPress 5.2.27
5.2.20
Fixed in WordPress 5.2.27
5.2.19
Fixed in WordPress 5.2.27
5.2.18
Fixed in WordPress 5.2.27
5.2.17
Fixed in WordPress 5.2.27
5.2.16
Fixed in WordPress 5.2.27
5.2.15
Fixed in WordPress 5.2.27
5.2.14
Fixed in WordPress 5.2.27
5.2.13
Fixed in WordPress 5.2.27
5.2.12
Fixed in WordPress 5.2.27
5.2.11
Fixed in WordPress 5.2.27
5.2.10
Fixed in WordPress 5.2.27
5.2.9
Fixed in WordPress 5.2.27
5.2.8
Fixed in WordPress 5.2.27
5.2.7
Fixed in WordPress 5.2.27
5.2.6
Fixed in WordPress 5.2.27
5.2.5
Fixed in WordPress 5.2.27
5.2.4
Fixed in WordPress 5.2.27
5.2.3
Fixed in WordPress 5.2.27
5.2.2
Fixed in WordPress 5.2.27
5.2.1
Fixed in WordPress 5.2.27
5.2
Fixed in WordPress 5.2.27
5.1.24
Fixed in WordPress 5.1.25
5.1.23
Fixed in WordPress 5.1.25
5.1.22
Fixed in WordPress 5.1.25
5.1.21
Fixed in WordPress 5.1.25
5.1.20
Fixed in WordPress 5.1.25
5.1.19
Fixed in WordPress 5.1.25
5.1.18
Fixed in WordPress 5.1.25
5.1.17
Fixed in WordPress 5.1.25
5.1.16
Fixed in WordPress 5.1.25
5.1.15
Fixed in WordPress 5.1.25
5.1.14
Fixed in WordPress 5.1.25
5.1.13
Fixed in WordPress 5.1.25
5.1.12
Fixed in WordPress 5.1.25
5.1.11
Fixed in WordPress 5.1.25
5.1.10
Fixed in WordPress 5.1.25
5.1.9
Fixed in WordPress 5.1.25
5.1.8
Fixed in WordPress 5.1.25
5.1.7
Fixed in WordPress 5.1.25
5.1.6
Fixed in WordPress 5.1.25
5.1.5
Fixed in WordPress 5.1.25
5.1.4
Fixed in WordPress 5.1.25
5.1.3
Fixed in WordPress 5.1.25
5.1.2
Fixed in WordPress 5.1.25
5.1.1
Fixed in WordPress 5.1.25
5.1
Fixed in WordPress 5.1.25
5.0.27
Fixed in WordPress 5.0.28
5.0.26
Fixed in WordPress 5.0.28
5.0.25
Fixed in WordPress 5.0.28
5.0.24
Fixed in WordPress 5.0.28
5.0.23
Fixed in WordPress 5.0.28
5.0.22
Fixed in WordPress 5.0.28
5.0.21
Fixed in WordPress 5.0.28
5.0.20
Fixed in WordPress 5.0.28
5.0.19
Fixed in WordPress 5.0.28
5.0.18
Fixed in WordPress 5.0.28
5.0.17
Fixed in WordPress 5.0.28
5.0.16
Fixed in WordPress 5.0.28
5.0.15
Fixed in WordPress 5.0.28
5.0.14
Fixed in WordPress 5.0.28
5.0.13
Fixed in WordPress 5.0.28
5.0.12
Fixed in WordPress 5.0.28
5.0.11
Fixed in WordPress 5.0.28
5.0.10
Fixed in WordPress 5.0.28
5.0.9
Fixed in WordPress 5.0.28
5.0.8
Fixed in WordPress 5.0.28
5.0.7
Fixed in WordPress 5.0.28
5.0.6
Fixed in WordPress 5.0.28
5.0.4
Fixed in WordPress 5.0.28
5.0.3
Fixed in WordPress 5.0.28
5.0.2
Fixed in WordPress 5.0.28
5.0.1
Fixed in WordPress 5.0.28
5.0
Fixed in WordPress 5.0.28
4.9.31
Fixed in WordPress 4.9.32
4.9.30
Fixed in WordPress 4.9.32
4.9.29
Fixed in WordPress 4.9.32
4.9.28
Fixed in WordPress 4.9.32
4.9.27
Fixed in WordPress 4.9.32
4.9.26
Fixed in WordPress 4.9.32
4.9.25
Fixed in WordPress 4.9.32
4.9.24
Fixed in WordPress 4.9.32
4.9.23
Fixed in WordPress 4.9.32
4.9.22
Fixed in WordPress 4.9.32
4.9.21
Fixed in WordPress 4.9.32
4.9.20
Fixed in WordPress 4.9.32
4.9.19
Fixed in WordPress 4.9.32
4.9.18
Fixed in WordPress 4.9.32
4.9.17
Fixed in WordPress 4.9.32
4.9.16
Fixed in WordPress 4.9.32
4.9.15
Fixed in WordPress 4.9.32
4.9.14
Fixed in WordPress 4.9.32
4.9.13
Fixed in WordPress 4.9.32
4.9.12
Fixed in WordPress 4.9.32
4.9.11
Fixed in WordPress 4.9.32
4.9.10
Fixed in WordPress 4.9.32
4.9.9
Fixed in WordPress 4.9.32
4.9.8
Fixed in WordPress 4.9.32
4.9.7
Fixed in WordPress 4.9.32
4.9.6
Fixed in WordPress 4.9.32
4.9.5
Fixed in WordPress 4.9.32
4.9.4
Fixed in WordPress 4.9.32
4.9.3
Fixed in WordPress 4.9.32
4.9.2
Fixed in WordPress 4.9.32
4.9.1
Fixed in WordPress 4.9.32
4.9
Fixed in WordPress 4.9.32
4.8.30
Fixed in WordPress 4.8.31
4.8.29
Fixed in WordPress 4.8.31
4.8.28
Fixed in WordPress 4.8.31
4.8.27
Fixed in WordPress 4.8.31
4.8.26
Fixed in WordPress 4.8.31
4.8.25
Fixed in WordPress 4.8.31
4.8.24
Fixed in WordPress 4.8.31
4.8.23
Fixed in WordPress 4.8.31
4.8.22
Fixed in WordPress 4.8.31
4.8.21
Fixed in WordPress 4.8.31
4.8.20
Fixed in WordPress 4.8.31
4.8.19
Fixed in WordPress 4.8.31
4.8.18
Fixed in WordPress 4.8.31
4.8.17
Fixed in WordPress 4.8.31
4.8.16
Fixed in WordPress 4.8.31
4.8.15
Fixed in WordPress 4.8.31
4.8.14
Fixed in WordPress 4.8.31
4.8.13
Fixed in WordPress 4.8.31
4.8.12
Fixed in WordPress 4.8.31
4.8.11
Fixed in WordPress 4.8.31
4.8.10
Fixed in WordPress 4.8.31
4.8.9
Fixed in WordPress 4.8.31
4.8.8
Fixed in WordPress 4.8.31
4.8.7
Fixed in WordPress 4.8.31
4.8.6
Fixed in WordPress 4.8.31
4.8.5
Fixed in WordPress 4.8.31
4.8.4
Fixed in WordPress 4.8.31
4.8.3
Fixed in WordPress 4.8.31
4.8.2
Fixed in WordPress 4.8.31
4.8.1
Fixed in WordPress 4.8.31
4.8
Fixed in WordPress 4.8.31
4.7.35
Fixed in WordPress 4.7.36
4.7.34
Fixed in WordPress 4.7.36
4.7.33
Fixed in WordPress 4.7.36
4.7.32
Fixed in WordPress 4.7.36
4.7.31
Fixed in WordPress 4.7.36
4.7.30
Fixed in WordPress 4.7.36
4.7.29
Fixed in WordPress 4.7.36
4.7.28
Fixed in WordPress 4.7.36
4.7.27
Fixed in WordPress 4.7.36
4.7.26
Fixed in WordPress 4.7.36
4.7.25
Fixed in WordPress 4.7.36
4.7.24
Fixed in WordPress 4.7.36
4.7.23
Fixed in WordPress 4.7.36
4.7.22
Fixed in WordPress 4.7.36
4.7.21
Fixed in WordPress 4.7.36
4.7.20
Fixed in WordPress 4.7.36
4.7.19
Fixed in WordPress 4.7.36
4.7.18
Fixed in WordPress 4.7.36
4.7.17
Fixed in WordPress 4.7.36
4.7.16
Fixed in WordPress 4.7.36
4.7.15
Fixed in WordPress 4.7.36
4.7.14
Fixed in WordPress 4.7.36
4.7.13
Fixed in WordPress 4.7.36
4.7.12
Fixed in WordPress 4.7.36
4.7.11
Fixed in WordPress 4.7.36
4.7.10
Fixed in WordPress 4.7.36
4.7.9
Fixed in WordPress 4.7.36
4.7.8
Fixed in WordPress 4.7.36
4.7.7
Fixed in WordPress 4.7.36
4.7.6
Fixed in WordPress 4.7.36
4.7.5
Fixed in WordPress 4.7.36
4.7.4
Fixed in WordPress 4.7.36
4.7.3
Fixed in WordPress 4.7.36
4.7.2
Fixed in WordPress 4.7.36
4.7.1
Fixed in WordPress 4.7.36
4.7
Fixed in WordPress 4.7.36

References

URL
https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
Yes
WPVDB ID
aa354358-3a32-4e81-8628-d1aa917b5efa

Timeline

Publicly Published
2026-09-17 (about 1 month ago)
Added
2026-09-18 (about 1 month ago)
Last Updated
2026-09-18 (about 1 month ago)

Other

Published
Title
Published
2025-12-29
Title
Visitor Stats Widget <= 1.5.0 - Reflected Cross-Site Scripting
Published
2025-09-03
Title
WordPress Assistant < 1.5.3 - Reflected Cross-Site Scripting
Published
2026-08-25
Title
Gutenverse < 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks
Published
2023-11-23
Title
Display Custom Post <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-01-02
Title
WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)