WordPress Vulnerabilities

WP 6.6 - 7.1.3 - Author+ Stored XSS via Interactivity Router

Description

WordPress does not verify that a fetched response was produced as a navigation page before processing it in some cases, which could allow users with author-level access and above to perform Stored Cross-Site Scripting attacks against users who follow a crafted link. This also affects the Gutenberg plugin.

Affects WordPress

6.6.10
Fixed in WordPress 6.6.11
6.6.9
Fixed in WordPress 6.6.11
6.6.8
Fixed in WordPress 6.6.11
6.6.7
Fixed in WordPress 6.6.11
6.6.6
Fixed in WordPress 6.6.11
6.6.5
Fixed in WordPress 6.6.11
6.6.4
Fixed in WordPress 6.6.11
6.6.3
Fixed in WordPress 6.6.11
6.6.2
Fixed in WordPress 6.6.11
6.6.1
Fixed in WordPress 6.6.11
6.6
Fixed in WordPress 6.6.11
6.7.10
Fixed in WordPress 6.7.11
6.7.9
Fixed in WordPress 6.7.11
6.7.8
Fixed in WordPress 6.7.11
6.7.7
Fixed in WordPress 6.7.11
6.7.6
Fixed in WordPress 6.7.11
6.7.5
Fixed in WordPress 6.7.11
6.7.4
Fixed in WordPress 6.7.11
6.7.3
Fixed in WordPress 6.7.11
6.7.2
Fixed in WordPress 6.7.11
6.7.1
Fixed in WordPress 6.7.11
6.7
Fixed in WordPress 6.7.11
6.8.11
Fixed in WordPress 6.8.12
6.8.10
Fixed in WordPress 6.8.12
6.8.9
Fixed in WordPress 6.8.12
6.8.8
Fixed in WordPress 6.8.12
6.8.7
Fixed in WordPress 6.8.12
6.8.6
Fixed in WordPress 6.8.12
6.8.5
Fixed in WordPress 6.8.12
6.8.4
Fixed in WordPress 6.8.12
6.8.3
Fixed in WordPress 6.8.12
6.8.2
Fixed in WordPress 6.8.12
6.8.1
Fixed in WordPress 6.8.12
6.8
Fixed in WordPress 6.8.12
6.9.10
Fixed in WordPress 6.9.11
6.9.9
Fixed in WordPress 6.9.11
6.9.8
Fixed in WordPress 6.9.11
6.9.7
Fixed in WordPress 6.9.11
6.9.6
Fixed in WordPress 6.9.11
6.9.5
Fixed in WordPress 6.9.11
6.9.4
Fixed in WordPress 6.9.11
6.9.3
Fixed in WordPress 6.9.11
6.9.2
Fixed in WordPress 6.9.11
6.9.1
Fixed in WordPress 6.9.11
6.9
Fixed in WordPress 6.9.11
7.0.7
Fixed in WordPress 7.0.8
7.0.6
Fixed in WordPress 7.0.8
7.0.5
Fixed in WordPress 7.0.8
7.0.4
Fixed in WordPress 7.0.8
7.0.3
Fixed in WordPress 7.0.8
7.0.2
Fixed in WordPress 7.0.8
7.0.1
Fixed in WordPress 7.0.8
7.0
Fixed in WordPress 7.0.8
7.1.3
Fixed in WordPress 7.1.4
7.1.2
Fixed in WordPress 7.1.4
7.1.1
Fixed in WordPress 7.1.4
7.1
Fixed in WordPress 7.1.4

Affects Plugins

Plugin icon
gutenberg
Fixed in 24.3.0

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-4/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
AnC and DatNLQ (VietSunshine Cyber Security)
Verified
Yes
WPVDB ID
b25a7850-e8ef-4979-83a8-7eeec0572d72

Timeline

Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 17 hours ago)
Last Updated
2026-10-29 (about 17 hours ago)

Other

Published
Title
Published
2026-08-18
Title
Affiliates Manager < 2.9.54 - Unauthenticated Stored Cross-Site Scripting
Published
2024-05-10
Title
Beaver Builder < 2.8.1.3 - Contributor+ Stored Cross-Site Scripting via photo widget crop attribute
Published
2025-01-15
Title
Online Payments < 3.30.0 - Contributor+ Stored XSS
Published
2024-04-15
Title
Simple Testimonials Showcase <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-08-30
Title
Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Caption On Hover