WordPress Vulnerabilities

WP 4.9 - 7.1.3 - Editor+ Stored XSS via Data Erasure Requests

Description

WordPress does not escape a user-supplied value before outputting it on an administrative screen in some cases, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks that run in the context of a logged-in administrator.

Affects WordPress

4.9
Fixed in WordPress 4.9.35
4.9.1
Fixed in WordPress 4.9.35
4.9.2
Fixed in WordPress 4.9.35
4.9.3
Fixed in WordPress 4.9.35
4.9.4
Fixed in WordPress 4.9.35
4.9.5
Fixed in WordPress 4.9.35
4.9.6
Fixed in WordPress 4.9.35
4.9.7
Fixed in WordPress 4.9.35
4.9.8
Fixed in WordPress 4.9.35
4.9.9
Fixed in WordPress 4.9.35
4.9.10
Fixed in WordPress 4.9.35
4.9.11
Fixed in WordPress 4.9.35
4.9.12
Fixed in WordPress 4.9.35
4.9.13
Fixed in WordPress 4.9.35
4.9.14
Fixed in WordPress 4.9.35
4.9.15
Fixed in WordPress 4.9.35
4.9.16
Fixed in WordPress 4.9.35
4.9.17
Fixed in WordPress 4.9.35
4.9.18
Fixed in WordPress 4.9.35
4.9.19
Fixed in WordPress 4.9.35
4.9.20
Fixed in WordPress 4.9.35
4.9.21
Fixed in WordPress 4.9.35
4.9.22
Fixed in WordPress 4.9.35
4.9.23
Fixed in WordPress 4.9.35
4.9.24
Fixed in WordPress 4.9.35
4.9.25
Fixed in WordPress 4.9.35
4.9.26
Fixed in WordPress 4.9.35
4.9.27
Fixed in WordPress 4.9.35
4.9.28
Fixed in WordPress 4.9.35
4.9.29
Fixed in WordPress 4.9.35
4.9.30
Fixed in WordPress 4.9.35
4.9.31
Fixed in WordPress 4.9.35
4.9.32
Fixed in WordPress 4.9.35
4.9.33
Fixed in WordPress 4.9.35
4.9.34
Fixed in WordPress 4.9.35
5.0
Fixed in WordPress 5.0.31
5.0.1
Fixed in WordPress 5.0.31
5.0.2
Fixed in WordPress 5.0.31
5.0.3
Fixed in WordPress 5.0.31
5.0.4
Fixed in WordPress 5.0.31
5.0.6
Fixed in WordPress 5.0.31
5.0.7
Fixed in WordPress 5.0.31
5.0.8
Fixed in WordPress 5.0.31
5.0.9
Fixed in WordPress 5.0.31
5.0.10
Fixed in WordPress 5.0.31
5.0.11
Fixed in WordPress 5.0.31
5.0.12
Fixed in WordPress 5.0.31
5.0.13
Fixed in WordPress 5.0.31
5.0.14
Fixed in WordPress 5.0.31
5.0.15
Fixed in WordPress 5.0.31
5.0.16
Fixed in WordPress 5.0.31
5.0.17
Fixed in WordPress 5.0.31
5.0.18
Fixed in WordPress 5.0.31
5.0.19
Fixed in WordPress 5.0.31
5.0.20
Fixed in WordPress 5.0.31
5.0.21
Fixed in WordPress 5.0.31
5.0.22
Fixed in WordPress 5.0.31
5.0.23
Fixed in WordPress 5.0.31
5.0.24
Fixed in WordPress 5.0.31
5.0.25
Fixed in WordPress 5.0.31
5.0.26
Fixed in WordPress 5.0.31
5.0.27
Fixed in WordPress 5.0.31
5.0.28
Fixed in WordPress 5.0.31
5.0.29
Fixed in WordPress 5.0.31
5.0.30
Fixed in WordPress 5.0.31
5.1
Fixed in WordPress 5.1.28
5.1.1
Fixed in WordPress 5.1.28
5.1.2
Fixed in WordPress 5.1.28
5.1.3
Fixed in WordPress 5.1.28
5.1.4
Fixed in WordPress 5.1.28
5.1.5
Fixed in WordPress 5.1.28
5.1.6
Fixed in WordPress 5.1.28
5.1.7
Fixed in WordPress 5.1.28
5.1.8
Fixed in WordPress 5.1.28
5.1.9
Fixed in WordPress 5.1.28
5.1.10
Fixed in WordPress 5.1.28
5.1.11
Fixed in WordPress 5.1.28
5.1.12
Fixed in WordPress 5.1.28
5.1.13
Fixed in WordPress 5.1.28
5.1.14
Fixed in WordPress 5.1.28
5.1.15
Fixed in WordPress 5.1.28
5.1.16
Fixed in WordPress 5.1.28
5.1.17
Fixed in WordPress 5.1.28
5.1.18
Fixed in WordPress 5.1.28
5.1.19
Fixed in WordPress 5.1.28
5.1.20
Fixed in WordPress 5.1.28
5.1.21
Fixed in WordPress 5.1.28
5.1.22
Fixed in WordPress 5.1.28
5.1.23
Fixed in WordPress 5.1.28
5.1.24
Fixed in WordPress 5.1.28
5.1.25
Fixed in WordPress 5.1.28
5.1.26
Fixed in WordPress 5.1.28
5.1.27
Fixed in WordPress 5.1.28
5.2
Fixed in WordPress 5.2.30
5.2.1
Fixed in WordPress 5.2.30
5.2.2
Fixed in WordPress 5.2.30
5.2.3
Fixed in WordPress 5.2.30
5.2.4
Fixed in WordPress 5.2.30
5.2.5
Fixed in WordPress 5.2.30
5.2.6
Fixed in WordPress 5.2.30
5.2.7
Fixed in WordPress 5.2.30
5.2.8
Fixed in WordPress 5.2.30
5.2.9
Fixed in WordPress 5.2.30
5.2.10
Fixed in WordPress 5.2.30
5.2.11
Fixed in WordPress 5.2.30
5.2.12
Fixed in WordPress 5.2.30
5.2.13
Fixed in WordPress 5.2.30
5.2.14
Fixed in WordPress 5.2.30
5.2.15
Fixed in WordPress 5.2.30
5.2.16
Fixed in WordPress 5.2.30
5.2.17
Fixed in WordPress 5.2.30
5.2.18
Fixed in WordPress 5.2.30
5.2.19
Fixed in WordPress 5.2.30
5.2.20
Fixed in WordPress 5.2.30
5.2.21
Fixed in WordPress 5.2.30
5.2.22
Fixed in WordPress 5.2.30
5.2.23
Fixed in WordPress 5.2.30
5.2.24
Fixed in WordPress 5.2.30
5.2.25
Fixed in WordPress 5.2.30
5.2.26
Fixed in WordPress 5.2.30
5.2.27
Fixed in WordPress 5.2.30
5.2.28
Fixed in WordPress 5.2.30
5.2.29
Fixed in WordPress 5.2.30
5.3
Fixed in WordPress 5.3.27
5.3.1
Fixed in WordPress 5.3.27
5.3.2
Fixed in WordPress 5.3.27
5.3.3
Fixed in WordPress 5.3.27
5.3.4
Fixed in WordPress 5.3.27
5.3.5
Fixed in WordPress 5.3.27
5.3.6
Fixed in WordPress 5.3.27
5.3.7
Fixed in WordPress 5.3.27
5.3.8
Fixed in WordPress 5.3.27
5.3.9
Fixed in WordPress 5.3.27
5.3.10
Fixed in WordPress 5.3.27
5.3.11
Fixed in WordPress 5.3.27
5.3.12
Fixed in WordPress 5.3.27
5.3.13
Fixed in WordPress 5.3.27
5.3.14
Fixed in WordPress 5.3.27
5.3.15
Fixed in WordPress 5.3.27
5.3.16
Fixed in WordPress 5.3.27
5.3.17
Fixed in WordPress 5.3.27
5.3.18
Fixed in WordPress 5.3.27
5.3.19
Fixed in WordPress 5.3.27
5.3.20
Fixed in WordPress 5.3.27
5.3.21
Fixed in WordPress 5.3.27
5.3.22
Fixed in WordPress 5.3.27
5.3.23
Fixed in WordPress 5.3.27
5.3.24
Fixed in WordPress 5.3.27
5.3.25
Fixed in WordPress 5.3.27
5.3.26
Fixed in WordPress 5.3.27
5.4
Fixed in WordPress 5.4.25
5.4.1
Fixed in WordPress 5.4.25
5.4.2
Fixed in WordPress 5.4.25
5.4.3
Fixed in WordPress 5.4.25
5.4.4
Fixed in WordPress 5.4.25
5.4.5
Fixed in WordPress 5.4.25
5.4.6
Fixed in WordPress 5.4.25
5.4.7
Fixed in WordPress 5.4.25
5.4.8
Fixed in WordPress 5.4.25
5.4.9
Fixed in WordPress 5.4.25
5.4.10
Fixed in WordPress 5.4.25
5.4.11
Fixed in WordPress 5.4.25
5.4.12
Fixed in WordPress 5.4.25
5.4.13
Fixed in WordPress 5.4.25
5.4.14
Fixed in WordPress 5.4.25
5.4.15
Fixed in WordPress 5.4.25
5.4.16
Fixed in WordPress 5.4.25
5.4.17
Fixed in WordPress 5.4.25
5.4.18
Fixed in WordPress 5.4.25
5.4.19
Fixed in WordPress 5.4.25
5.4.20
Fixed in WordPress 5.4.25
5.4.21
Fixed in WordPress 5.4.25
5.4.22
Fixed in WordPress 5.4.25
5.4.23
Fixed in WordPress 5.4.25
5.4.24
Fixed in WordPress 5.4.25
5.5
Fixed in WordPress 5.5.24
5.5.1
Fixed in WordPress 5.5.24
5.5.2
Fixed in WordPress 5.5.24
5.5.3
Fixed in WordPress 5.5.24
5.5.4
Fixed in WordPress 5.5.24
5.5.5
Fixed in WordPress 5.5.24
5.5.6
Fixed in WordPress 5.5.24
5.5.7
Fixed in WordPress 5.5.24
5.5.8
Fixed in WordPress 5.5.24
5.5.9
Fixed in WordPress 5.5.24
5.5.10
Fixed in WordPress 5.5.24
5.5.11
Fixed in WordPress 5.5.24
5.5.12
Fixed in WordPress 5.5.24
5.5.13
Fixed in WordPress 5.5.24
5.5.14
Fixed in WordPress 5.5.24
5.5.15
Fixed in WordPress 5.5.24
5.5.16
Fixed in WordPress 5.5.24
5.5.17
Fixed in WordPress 5.5.24
5.5.18
Fixed in WordPress 5.5.24
5.5.19
Fixed in WordPress 5.5.24
5.5.20
Fixed in WordPress 5.5.24
5.5.21
Fixed in WordPress 5.5.24
5.5.22
Fixed in WordPress 5.5.24
5.5.23
Fixed in WordPress 5.5.24
5.6
Fixed in WordPress 5.6.23
5.6.1
Fixed in WordPress 5.6.23
5.6.2
Fixed in WordPress 5.6.23
5.6.3
Fixed in WordPress 5.6.23
5.6.4
Fixed in WordPress 5.6.23
5.6.5
Fixed in WordPress 5.6.23
5.6.6
Fixed in WordPress 5.6.23
5.6.7
Fixed in WordPress 5.6.23
5.6.8
Fixed in WordPress 5.6.23
5.6.9
Fixed in WordPress 5.6.23
5.6.10
Fixed in WordPress 5.6.23
5.6.11
Fixed in WordPress 5.6.23
5.6.12
Fixed in WordPress 5.6.23
5.6.13
Fixed in WordPress 5.6.23
5.6.14
Fixed in WordPress 5.6.23
5.6.15
Fixed in WordPress 5.6.23
5.6.16
Fixed in WordPress 5.6.23
5.6.17
Fixed in WordPress 5.6.23
5.6.18
Fixed in WordPress 5.6.23
5.6.19
Fixed in WordPress 5.6.23
5.6.20
Fixed in WordPress 5.6.23
5.6.21
Fixed in WordPress 5.6.23
5.6.22
Fixed in WordPress 5.6.23
5.7
Fixed in WordPress 5.7.21
5.7.1
Fixed in WordPress 5.7.21
5.7.2
Fixed in WordPress 5.7.21
5.7.3
Fixed in WordPress 5.7.21
5.7.4
Fixed in WordPress 5.7.21
5.7.5
Fixed in WordPress 5.7.21
5.7.6
Fixed in WordPress 5.7.21
5.7.7
Fixed in WordPress 5.7.21
5.7.8
Fixed in WordPress 5.7.21
5.7.9
Fixed in WordPress 5.7.21
5.7.10
Fixed in WordPress 5.7.21
5.7.11
Fixed in WordPress 5.7.21
5.7.12
Fixed in WordPress 5.7.21
5.7.13
Fixed in WordPress 5.7.21
5.7.14
Fixed in WordPress 5.7.21
5.7.15
Fixed in WordPress 5.7.21
5.7.16
Fixed in WordPress 5.7.21
5.7.17
Fixed in WordPress 5.7.21
5.7.18
Fixed in WordPress 5.7.21
5.7.19
Fixed in WordPress 5.7.21
5.7.20
Fixed in WordPress 5.7.21
5.8
Fixed in WordPress 5.8.19
5.8.1
Fixed in WordPress 5.8.19
5.8.2
Fixed in WordPress 5.8.19
5.8.3
Fixed in WordPress 5.8.19
5.8.4
Fixed in WordPress 5.8.19
5.8.5
Fixed in WordPress 5.8.19
5.8.6
Fixed in WordPress 5.8.19
5.8.7
Fixed in WordPress 5.8.19
5.8.8
Fixed in WordPress 5.8.19
5.8.9
Fixed in WordPress 5.8.19
5.8.10
Fixed in WordPress 5.8.19
5.8.11
Fixed in WordPress 5.8.19
5.8.12
Fixed in WordPress 5.8.19
5.8.13
Fixed in WordPress 5.8.19
5.8.14
Fixed in WordPress 5.8.19
5.8.15
Fixed in WordPress 5.8.19
5.8.16
Fixed in WordPress 5.8.19
5.8.17
Fixed in WordPress 5.8.19
5.8.18
Fixed in WordPress 5.8.19
5.9
Fixed in WordPress 5.9.20
5.9.1
Fixed in WordPress 5.9.20
5.9.2
Fixed in WordPress 5.9.20
5.9.3
Fixed in WordPress 5.9.20
5.9.4
Fixed in WordPress 5.9.20
5.9.5
Fixed in WordPress 5.9.20
5.9.6
Fixed in WordPress 5.9.20
5.9.7
Fixed in WordPress 5.9.20
5.9.8
Fixed in WordPress 5.9.20
5.9.9
Fixed in WordPress 5.9.20
5.9.10
Fixed in WordPress 5.9.20
5.9.11
Fixed in WordPress 5.9.20
5.9.12
Fixed in WordPress 5.9.20
5.9.13
Fixed in WordPress 5.9.20
5.9.14
Fixed in WordPress 5.9.20
5.9.15
Fixed in WordPress 5.9.20
5.9.16
Fixed in WordPress 5.9.20
5.9.17
Fixed in WordPress 5.9.20
5.9.18
Fixed in WordPress 5.9.20
5.9.19
Fixed in WordPress 5.9.20
6.0
Fixed in WordPress 6.0.18
6.0.1
Fixed in WordPress 6.0.18
6.0.2
Fixed in WordPress 6.0.18
6.0.3
Fixed in WordPress 6.0.18
6.0.4
Fixed in WordPress 6.0.18
6.0.5
Fixed in WordPress 6.0.18
6.0.6
Fixed in WordPress 6.0.18
6.0.7
Fixed in WordPress 6.0.18
6.0.8
Fixed in WordPress 6.0.18
6.0.9
Fixed in WordPress 6.0.18
6.0.10
Fixed in WordPress 6.0.18
6.0.11
Fixed in WordPress 6.0.18
6.0.12
Fixed in WordPress 6.0.18
6.0.13
Fixed in WordPress 6.0.18
6.0.14
Fixed in WordPress 6.0.18
6.0.15
Fixed in WordPress 6.0.18
6.0.16
Fixed in WordPress 6.0.18
6.0.17
Fixed in WordPress 6.0.18
6.1
Fixed in WordPress 6.1.16
6.1.1
Fixed in WordPress 6.1.16
6.1.2
Fixed in WordPress 6.1.16
6.1.3
Fixed in WordPress 6.1.16
6.1.4
Fixed in WordPress 6.1.16
6.1.5
Fixed in WordPress 6.1.16
6.1.6
Fixed in WordPress 6.1.16
6.1.7
Fixed in WordPress 6.1.16
6.1.8
Fixed in WordPress 6.1.16
6.1.9
Fixed in WordPress 6.1.16
6.1.10
Fixed in WordPress 6.1.16
6.1.11
Fixed in WordPress 6.1.16
6.1.12
Fixed in WordPress 6.1.16
6.1.13
Fixed in WordPress 6.1.16
6.1.14
Fixed in WordPress 6.1.16
6.1.15
Fixed in WordPress 6.1.16
6.2
Fixed in WordPress 6.2.15
6.2.1
Fixed in WordPress 6.2.15
6.2.2
Fixed in WordPress 6.2.15
6.2.3
Fixed in WordPress 6.2.15
6.2.4
Fixed in WordPress 6.2.15
6.2.5
Fixed in WordPress 6.2.15
6.2.6
Fixed in WordPress 6.2.15
6.2.7
Fixed in WordPress 6.2.15
6.2.8
Fixed in WordPress 6.2.15
6.2.9
Fixed in WordPress 6.2.15
6.2.10
Fixed in WordPress 6.2.15
6.2.11
Fixed in WordPress 6.2.15
6.2.12
Fixed in WordPress 6.2.15
6.2.13
Fixed in WordPress 6.2.15
6.2.14
Fixed in WordPress 6.2.15
6.3
Fixed in WordPress 6.3.14
6.3.1
Fixed in WordPress 6.3.14
6.3.2
Fixed in WordPress 6.3.14
6.3.3
Fixed in WordPress 6.3.14
6.3.4
Fixed in WordPress 6.3.14
6.3.5
Fixed in WordPress 6.3.14
6.3.6
Fixed in WordPress 6.3.14
6.3.7
Fixed in WordPress 6.3.14
6.3.8
Fixed in WordPress 6.3.14
6.3.9
Fixed in WordPress 6.3.14
6.3.10
Fixed in WordPress 6.3.14
6.3.11
Fixed in WordPress 6.3.14
6.3.12
Fixed in WordPress 6.3.14
6.3.13
Fixed in WordPress 6.3.14
6.4
Fixed in WordPress 6.4.14
6.4.1
Fixed in WordPress 6.4.14
6.4.2
Fixed in WordPress 6.4.14
6.4.3
Fixed in WordPress 6.4.14
6.4.4
Fixed in WordPress 6.4.14
6.4.5
Fixed in WordPress 6.4.14
6.4.6
Fixed in WordPress 6.4.14
6.4.7
Fixed in WordPress 6.4.14
6.4.8
Fixed in WordPress 6.4.14
6.4.9
Fixed in WordPress 6.4.14
6.4.10
Fixed in WordPress 6.4.14
6.4.11
Fixed in WordPress 6.4.14
6.4.12
Fixed in WordPress 6.4.14
6.4.13
Fixed in WordPress 6.4.14
6.5
Fixed in WordPress 6.5.14
6.5.2
Fixed in WordPress 6.5.14
6.5.3
Fixed in WordPress 6.5.14
6.5.4
Fixed in WordPress 6.5.14
6.5.5
Fixed in WordPress 6.5.14
6.5.6
Fixed in WordPress 6.5.14
6.5.7
Fixed in WordPress 6.5.14
6.5.8
Fixed in WordPress 6.5.14
6.5.9
Fixed in WordPress 6.5.14
6.5.10
Fixed in WordPress 6.5.14
6.5.11
Fixed in WordPress 6.5.14
6.5.12
Fixed in WordPress 6.5.14
6.5.13
Fixed in WordPress 6.5.14
6.6
Fixed in WordPress 6.6.11
6.6.1
Fixed in WordPress 6.6.11
6.6.2
Fixed in WordPress 6.6.11
6.6.3
Fixed in WordPress 6.6.11
6.6.4
Fixed in WordPress 6.6.11
6.6.5
Fixed in WordPress 6.6.11
6.6.6
Fixed in WordPress 6.6.11
6.6.7
Fixed in WordPress 6.6.11
6.6.8
Fixed in WordPress 6.6.11
6.6.9
Fixed in WordPress 6.6.11
6.6.10
Fixed in WordPress 6.6.11
6.7
Fixed in WordPress 6.7.11
6.7.1
Fixed in WordPress 6.7.11
6.7.2
Fixed in WordPress 6.7.11
6.7.3
Fixed in WordPress 6.7.11
6.7.4
Fixed in WordPress 6.7.11
6.7.5
Fixed in WordPress 6.7.11
6.7.6
Fixed in WordPress 6.7.11
6.7.7
Fixed in WordPress 6.7.11
6.7.8
Fixed in WordPress 6.7.11
6.7.9
Fixed in WordPress 6.7.11
6.7.10
Fixed in WordPress 6.7.11
6.8
Fixed in WordPress 6.8.12
6.8.1
Fixed in WordPress 6.8.12
6.8.2
Fixed in WordPress 6.8.12
6.8.3
Fixed in WordPress 6.8.12
6.8.4
Fixed in WordPress 6.8.12
6.8.5
Fixed in WordPress 6.8.12
6.8.6
Fixed in WordPress 6.8.12
6.8.7
Fixed in WordPress 6.8.12
6.8.8
Fixed in WordPress 6.8.12
6.8.9
Fixed in WordPress 6.8.12
6.8.10
Fixed in WordPress 6.8.12
6.8.11
Fixed in WordPress 6.8.12
6.9
Fixed in WordPress 6.9.11
6.9.1
Fixed in WordPress 6.9.11
6.9.2
Fixed in WordPress 6.9.11
6.9.3
Fixed in WordPress 6.9.11
6.9.4
Fixed in WordPress 6.9.11
6.9.5
Fixed in WordPress 6.9.11
6.9.6
Fixed in WordPress 6.9.11
6.9.7
Fixed in WordPress 6.9.11
6.9.8
Fixed in WordPress 6.9.11
6.9.9
Fixed in WordPress 6.9.11
6.9.10
Fixed in WordPress 6.9.11
7.0
Fixed in WordPress 7.0.8
7.0.1
Fixed in WordPress 7.0.8
7.0.2
Fixed in WordPress 7.0.8
7.0.3
Fixed in WordPress 7.0.8
7.0.4
Fixed in WordPress 7.0.8
7.0.5
Fixed in WordPress 7.0.8
7.0.6
Fixed in WordPress 7.0.8
7.0.7
Fixed in WordPress 7.0.8
7.1
Fixed in WordPress 7.1.4
7.1.1
Fixed in WordPress 7.1.4
7.1.2
Fixed in WordPress 7.1.4
7.1.3
Fixed in WordPress 7.1.4

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-4/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Anthropic
Verified
Yes
WPVDB ID
c8dfc828-0091-4679-b11d-2233531d1498

Timeline

Publicly Published
2026-10-29 (about 2 days ago)
Added
2026-10-29 (about 1 day ago)
Last Updated
2026-10-29 (about 1 day ago)

Other

Published
Title
Published
2026-02-25
Title
EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'
Published
2024-03-25
Title
WPFront Notification Bar < 3.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2025-02-26
Title
Meintopf <= 0.2.1 - Reflected XSS
Published
2024-11-27
Title
EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor < 4.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'
Published
2024-03-05
Title
Social Sharing Plugin – Sassy Social Share < 3.3.59 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode