WordPress Vulnerabilities

WP 5.0 - 7.1.3 - Contributor+ Stored XSS via Block Markup Parsing

Description

WordPress does not correctly sanitise block attribute content in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks against higher-privileged users such as administrators. This also affects the Gutenberg plugin.

Affects WordPress

5.0.30
Fixed in WordPress 5.0.31
5.0.29
Fixed in WordPress 5.0.31
5.0.28
Fixed in WordPress 5.0.31
5.0.27
Fixed in WordPress 5.0.31
5.0.26
Fixed in WordPress 5.0.31
5.0.25
Fixed in WordPress 5.0.31
5.0.24
Fixed in WordPress 5.0.31
5.0.23
Fixed in WordPress 5.0.31
5.0.22
Fixed in WordPress 5.0.31
5.0.21
Fixed in WordPress 5.0.31
5.0.20
Fixed in WordPress 5.0.31
5.0.19
Fixed in WordPress 5.0.31
5.0.18
Fixed in WordPress 5.0.31
5.0.17
Fixed in WordPress 5.0.31
5.0.16
Fixed in WordPress 5.0.31
5.0.15
Fixed in WordPress 5.0.31
5.0.14
Fixed in WordPress 5.0.31
5.0.13
Fixed in WordPress 5.0.31
5.0.12
Fixed in WordPress 5.0.31
5.0.11
Fixed in WordPress 5.0.31
5.0.10
Fixed in WordPress 5.0.31
5.0.9
Fixed in WordPress 5.0.31
5.0.8
Fixed in WordPress 5.0.31
5.0.7
Fixed in WordPress 5.0.31
5.0.6
Fixed in WordPress 5.0.31
5.0.4
Fixed in WordPress 5.0.31
5.0.3
Fixed in WordPress 5.0.31
5.0.2
Fixed in WordPress 5.0.31
5.0.1
Fixed in WordPress 5.0.31
5.0
Fixed in WordPress 5.0.31
5.1.27
Fixed in WordPress 5.1.28
5.1.26
Fixed in WordPress 5.1.28
5.1.25
Fixed in WordPress 5.1.28
5.1.24
Fixed in WordPress 5.1.28
5.1.23
Fixed in WordPress 5.1.28
5.1.22
Fixed in WordPress 5.1.28
5.1.21
Fixed in WordPress 5.1.28
5.1.20
Fixed in WordPress 5.1.28
5.1.19
Fixed in WordPress 5.1.28
5.1.18
Fixed in WordPress 5.1.28
5.1.17
Fixed in WordPress 5.1.28
5.1.16
Fixed in WordPress 5.1.28
5.1.15
Fixed in WordPress 5.1.28
5.1.14
Fixed in WordPress 5.1.28
5.1.13
Fixed in WordPress 5.1.28
5.1.12
Fixed in WordPress 5.1.28
5.1.11
Fixed in WordPress 5.1.28
5.1.10
Fixed in WordPress 5.1.28
5.1.9
Fixed in WordPress 5.1.28
5.1.8
Fixed in WordPress 5.1.28
5.1.7
Fixed in WordPress 5.1.28
5.1.6
Fixed in WordPress 5.1.28
5.1.5
Fixed in WordPress 5.1.28
5.1.4
Fixed in WordPress 5.1.28
5.1.3
Fixed in WordPress 5.1.28
5.1.2
Fixed in WordPress 5.1.28
5.1.1
Fixed in WordPress 5.1.28
5.1
Fixed in WordPress 5.1.28
5.2.29
Fixed in WordPress 5.2.30
5.2.28
Fixed in WordPress 5.2.30
5.2.27
Fixed in WordPress 5.2.30
5.2.26
Fixed in WordPress 5.2.30
5.2.25
Fixed in WordPress 5.2.30
5.2.24
Fixed in WordPress 5.2.30
5.2.23
Fixed in WordPress 5.2.30
5.2.22
Fixed in WordPress 5.2.30
5.2.21
Fixed in WordPress 5.2.30
5.2.20
Fixed in WordPress 5.2.30
5.2.19
Fixed in WordPress 5.2.30
5.2.18
Fixed in WordPress 5.2.30
5.2.17
Fixed in WordPress 5.2.30
5.2.16
Fixed in WordPress 5.2.30
5.2.15
Fixed in WordPress 5.2.30
5.2.14
Fixed in WordPress 5.2.30
5.2.13
Fixed in WordPress 5.2.30
5.2.12
Fixed in WordPress 5.2.30
5.2.11
Fixed in WordPress 5.2.30
5.2.10
Fixed in WordPress 5.2.30
5.2.9
Fixed in WordPress 5.2.30
5.2.8
Fixed in WordPress 5.2.30
5.2.7
Fixed in WordPress 5.2.30
5.2.6
Fixed in WordPress 5.2.30
5.2.5
Fixed in WordPress 5.2.30
5.2.4
Fixed in WordPress 5.2.30
5.2.3
Fixed in WordPress 5.2.30
5.2.2
Fixed in WordPress 5.2.30
5.2.1
Fixed in WordPress 5.2.30
5.2
Fixed in WordPress 5.2.30
5.3.26
Fixed in WordPress 5.3.27
5.3.25
Fixed in WordPress 5.3.27
5.3.24
Fixed in WordPress 5.3.27
5.3.23
Fixed in WordPress 5.3.27
5.3.22
Fixed in WordPress 5.3.27
5.3.21
Fixed in WordPress 5.3.27
5.3.20
Fixed in WordPress 5.3.27
5.3.19
Fixed in WordPress 5.3.27
5.3.18
Fixed in WordPress 5.3.27
5.3.17
Fixed in WordPress 5.3.27
5.3.16
Fixed in WordPress 5.3.27
5.3.15
Fixed in WordPress 5.3.27
5.3.14
Fixed in WordPress 5.3.27
5.3.13
Fixed in WordPress 5.3.27
5.3.12
Fixed in WordPress 5.3.27
5.3.11
Fixed in WordPress 5.3.27
5.3.10
Fixed in WordPress 5.3.27
5.3.9
Fixed in WordPress 5.3.27
5.3.8
Fixed in WordPress 5.3.27
5.3.7
Fixed in WordPress 5.3.27
5.3.6
Fixed in WordPress 5.3.27
5.3.5
Fixed in WordPress 5.3.27
5.3.4
Fixed in WordPress 5.3.27
5.3.3
Fixed in WordPress 5.3.27
5.3.2
Fixed in WordPress 5.3.27
5.3.1
Fixed in WordPress 5.3.27
5.3
Fixed in WordPress 5.3.27
5.4.24
Fixed in WordPress 5.4.25
5.4.23
Fixed in WordPress 5.4.25
5.4.22
Fixed in WordPress 5.4.25
5.4.21
Fixed in WordPress 5.4.25
5.4.20
Fixed in WordPress 5.4.25
5.4.19
Fixed in WordPress 5.4.25
5.4.18
Fixed in WordPress 5.4.25
5.4.17
Fixed in WordPress 5.4.25
5.4.16
Fixed in WordPress 5.4.25
5.4.15
Fixed in WordPress 5.4.25
5.4.14
Fixed in WordPress 5.4.25
5.4.13
Fixed in WordPress 5.4.25
5.4.12
Fixed in WordPress 5.4.25
5.4.11
Fixed in WordPress 5.4.25
5.4.10
Fixed in WordPress 5.4.25
5.4.9
Fixed in WordPress 5.4.25
5.4.8
Fixed in WordPress 5.4.25
5.4.7
Fixed in WordPress 5.4.25
5.4.6
Fixed in WordPress 5.4.25
5.4.5
Fixed in WordPress 5.4.25
5.4.4
Fixed in WordPress 5.4.25
5.4.3
Fixed in WordPress 5.4.25
5.4.2
Fixed in WordPress 5.4.25
5.4.1
Fixed in WordPress 5.4.25
5.4
Fixed in WordPress 5.4.25
5.5.23
Fixed in WordPress 5.5.24
5.5.22
Fixed in WordPress 5.5.24
5.5.21
Fixed in WordPress 5.5.24
5.5.20
Fixed in WordPress 5.5.24
5.5.19
Fixed in WordPress 5.5.24
5.5.18
Fixed in WordPress 5.5.24
5.5.17
Fixed in WordPress 5.5.24
5.5.16
Fixed in WordPress 5.5.24
5.5.15
Fixed in WordPress 5.5.24
5.5.14
Fixed in WordPress 5.5.24
5.5.13
Fixed in WordPress 5.5.24
5.5.12
Fixed in WordPress 5.5.24
5.5.11
Fixed in WordPress 5.5.24
5.5.10
Fixed in WordPress 5.5.24
5.5.9
Fixed in WordPress 5.5.24
5.5.8
Fixed in WordPress 5.5.24
5.5.7
Fixed in WordPress 5.5.24
5.5.6
Fixed in WordPress 5.5.24
5.5.5
Fixed in WordPress 5.5.24
5.5.4
Fixed in WordPress 5.5.24
5.5.3
Fixed in WordPress 5.5.24
5.5.2
Fixed in WordPress 5.5.24
5.5.1
Fixed in WordPress 5.5.24
5.5
Fixed in WordPress 5.5.24
5.6.22
Fixed in WordPress 5.6.23
5.6.21
Fixed in WordPress 5.6.23
5.6.20
Fixed in WordPress 5.6.23
5.6.19
Fixed in WordPress 5.6.23
5.6.18
Fixed in WordPress 5.6.23
5.6.17
Fixed in WordPress 5.6.23
5.6.16
Fixed in WordPress 5.6.23
5.6.15
Fixed in WordPress 5.6.23
5.6.14
Fixed in WordPress 5.6.23
5.6.13
Fixed in WordPress 5.6.23
5.6.12
Fixed in WordPress 5.6.23
5.6.11
Fixed in WordPress 5.6.23
5.6.10
Fixed in WordPress 5.6.23
5.6.9
Fixed in WordPress 5.6.23
5.6.8
Fixed in WordPress 5.6.23
5.6.7
Fixed in WordPress 5.6.23
5.6.6
Fixed in WordPress 5.6.23
5.6.5
Fixed in WordPress 5.6.23
5.6.4
Fixed in WordPress 5.6.23
5.6.3
Fixed in WordPress 5.6.23
5.6.2
Fixed in WordPress 5.6.23
5.6.1
Fixed in WordPress 5.6.23
5.6
Fixed in WordPress 5.6.23
5.7.20
Fixed in WordPress 5.7.21
5.7.19
Fixed in WordPress 5.7.21
5.7.18
Fixed in WordPress 5.7.21
5.7.17
Fixed in WordPress 5.7.21
5.7.16
Fixed in WordPress 5.7.21
5.7.15
Fixed in WordPress 5.7.21
5.7.14
Fixed in WordPress 5.7.21
5.7.13
Fixed in WordPress 5.7.21
5.7.12
Fixed in WordPress 5.7.21
5.7.11
Fixed in WordPress 5.7.21
5.7.10
Fixed in WordPress 5.7.21
5.7.9
Fixed in WordPress 5.7.21
5.7.8
Fixed in WordPress 5.7.21
5.7.7
Fixed in WordPress 5.7.21
5.7.6
Fixed in WordPress 5.7.21
5.7.5
Fixed in WordPress 5.7.21
5.7.4
Fixed in WordPress 5.7.21
5.7.3
Fixed in WordPress 5.7.21
5.7.2
Fixed in WordPress 5.7.21
5.7.1
Fixed in WordPress 5.7.21
5.7
Fixed in WordPress 5.7.21
5.8.18
Fixed in WordPress 5.8.19
5.8.17
Fixed in WordPress 5.8.19
5.8.16
Fixed in WordPress 5.8.19
5.8.15
Fixed in WordPress 5.8.19
5.8.14
Fixed in WordPress 5.8.19
5.8.13
Fixed in WordPress 5.8.19
5.8.12
Fixed in WordPress 5.8.19
5.8.11
Fixed in WordPress 5.8.19
5.8.10
Fixed in WordPress 5.8.19
5.8.9
Fixed in WordPress 5.8.19
5.8.8
Fixed in WordPress 5.8.19
5.8.7
Fixed in WordPress 5.8.19
5.8.6
Fixed in WordPress 5.8.19
5.8.5
Fixed in WordPress 5.8.19
5.8.4
Fixed in WordPress 5.8.19
5.8.3
Fixed in WordPress 5.8.19
5.8.2
Fixed in WordPress 5.8.19
5.8.1
Fixed in WordPress 5.8.19
5.8
Fixed in WordPress 5.8.19
5.9.19
Fixed in WordPress 5.9.20
5.9.18
Fixed in WordPress 5.9.20
5.9.17
Fixed in WordPress 5.9.20
5.9.16
Fixed in WordPress 5.9.20
5.9.15
Fixed in WordPress 5.9.20
5.9.14
Fixed in WordPress 5.9.20
5.9.13
Fixed in WordPress 5.9.20
5.9.12
Fixed in WordPress 5.9.20
5.9.11
Fixed in WordPress 5.9.20
5.9.10
Fixed in WordPress 5.9.20
5.9.9
Fixed in WordPress 5.9.20
5.9.8
Fixed in WordPress 5.9.20
5.9.7
Fixed in WordPress 5.9.20
5.9.6
Fixed in WordPress 5.9.20
5.9.5
Fixed in WordPress 5.9.20
5.9.4
Fixed in WordPress 5.9.20
5.9.3
Fixed in WordPress 5.9.20
5.9.2
Fixed in WordPress 5.9.20
5.9.1
Fixed in WordPress 5.9.20
5.9
Fixed in WordPress 5.9.20
6.0.17
Fixed in WordPress 6.0.18
6.0.16
Fixed in WordPress 6.0.18
6.0.15
Fixed in WordPress 6.0.18
6.0.14
Fixed in WordPress 6.0.18
6.0.13
Fixed in WordPress 6.0.18
6.0.12
Fixed in WordPress 6.0.18
6.0.11
Fixed in WordPress 6.0.18
6.0.10
Fixed in WordPress 6.0.18
6.0.9
Fixed in WordPress 6.0.18
6.0.8
Fixed in WordPress 6.0.18
6.0.7
Fixed in WordPress 6.0.18
6.0.6
Fixed in WordPress 6.0.18
6.0.5
Fixed in WordPress 6.0.18
6.0.4
Fixed in WordPress 6.0.18
6.0.3
Fixed in WordPress 6.0.18
6.0.2
Fixed in WordPress 6.0.18
6.0.1
Fixed in WordPress 6.0.18
6.0
Fixed in WordPress 6.0.18
6.1.15
Fixed in WordPress 6.1.16
6.1.14
Fixed in WordPress 6.1.16
6.1.13
Fixed in WordPress 6.1.16
6.1.12
Fixed in WordPress 6.1.16
6.1.11
Fixed in WordPress 6.1.16
6.1.10
Fixed in WordPress 6.1.16
6.1.9
Fixed in WordPress 6.1.16
6.1.8
Fixed in WordPress 6.1.16
6.1.7
Fixed in WordPress 6.1.16
6.1.6
Fixed in WordPress 6.1.16
6.1.5
Fixed in WordPress 6.1.16
6.1.4
Fixed in WordPress 6.1.16
6.1.3
Fixed in WordPress 6.1.16
6.1.2
Fixed in WordPress 6.1.16
6.1.1
Fixed in WordPress 6.1.16
6.1
Fixed in WordPress 6.1.16
6.2.14
Fixed in WordPress 6.2.15
6.2.13
Fixed in WordPress 6.2.15
6.2.12
Fixed in WordPress 6.2.15
6.2.11
Fixed in WordPress 6.2.15
6.2.10
Fixed in WordPress 6.2.15
6.2.9
Fixed in WordPress 6.2.15
6.2.8
Fixed in WordPress 6.2.15
6.2.7
Fixed in WordPress 6.2.15
6.2.6
Fixed in WordPress 6.2.15
6.2.5
Fixed in WordPress 6.2.15
6.2.4
Fixed in WordPress 6.2.15
6.2.3
Fixed in WordPress 6.2.15
6.2.2
Fixed in WordPress 6.2.15
6.2.1
Fixed in WordPress 6.2.15
6.2
Fixed in WordPress 6.2.15
6.3.13
Fixed in WordPress 6.3.14
6.3.12
Fixed in WordPress 6.3.14
6.3.11
Fixed in WordPress 6.3.14
6.3.10
Fixed in WordPress 6.3.14
6.3.9
Fixed in WordPress 6.3.14
6.3.8
Fixed in WordPress 6.3.14
6.3.7
Fixed in WordPress 6.3.14
6.3.6
Fixed in WordPress 6.3.14
6.3.5
Fixed in WordPress 6.3.14
6.3.4
Fixed in WordPress 6.3.14
6.3.3
Fixed in WordPress 6.3.14
6.3.2
Fixed in WordPress 6.3.14
6.3.1
Fixed in WordPress 6.3.14
6.3
Fixed in WordPress 6.3.14
6.4.13
Fixed in WordPress 6.4.14
6.4.12
Fixed in WordPress 6.4.14
6.4.11
Fixed in WordPress 6.4.14
6.4.10
Fixed in WordPress 6.4.14
6.4.9
Fixed in WordPress 6.4.14
6.4.8
Fixed in WordPress 6.4.14
6.4.7
Fixed in WordPress 6.4.14
6.4.6
Fixed in WordPress 6.4.14
6.4.5
Fixed in WordPress 6.4.14
6.4.4
Fixed in WordPress 6.4.14
6.4.3
Fixed in WordPress 6.4.14
6.4.2
Fixed in WordPress 6.4.14
6.4.1
Fixed in WordPress 6.4.14
6.4
Fixed in WordPress 6.4.14
6.5.13
Fixed in WordPress 6.5.14
6.5.12
Fixed in WordPress 6.5.14
6.5.11
Fixed in WordPress 6.5.14
6.5.10
Fixed in WordPress 6.5.14
6.5.9
Fixed in WordPress 6.5.14
6.5.8
Fixed in WordPress 6.5.14
6.5.7
Fixed in WordPress 6.5.14
6.5.6
Fixed in WordPress 6.5.14
6.5.5
Fixed in WordPress 6.5.14
6.5.4
Fixed in WordPress 6.5.14
6.5.3
Fixed in WordPress 6.5.14
6.5.2
Fixed in WordPress 6.5.14
6.5
Fixed in WordPress 6.5.14
6.6.10
Fixed in WordPress 6.6.11
6.6.9
Fixed in WordPress 6.6.11
6.6.8
Fixed in WordPress 6.6.11
6.6.7
Fixed in WordPress 6.6.11
6.6.6
Fixed in WordPress 6.6.11
6.6.5
Fixed in WordPress 6.6.11
6.6.4
Fixed in WordPress 6.6.11
6.6.3
Fixed in WordPress 6.6.11
6.6.2
Fixed in WordPress 6.6.11
6.6.1
Fixed in WordPress 6.6.11
6.6
Fixed in WordPress 6.6.11
6.7.10
Fixed in WordPress 6.7.11
6.7.9
Fixed in WordPress 6.7.11
6.7.8
Fixed in WordPress 6.7.11
6.7.7
Fixed in WordPress 6.7.11
6.7.6
Fixed in WordPress 6.7.11
6.7.5
Fixed in WordPress 6.7.11
6.7.4
Fixed in WordPress 6.7.11
6.7.3
Fixed in WordPress 6.7.11
6.7.2
Fixed in WordPress 6.7.11
6.7.1
Fixed in WordPress 6.7.11
6.7
Fixed in WordPress 6.7.11
6.8.11
Fixed in WordPress 6.8.12
6.8.10
Fixed in WordPress 6.8.12
6.8.9
Fixed in WordPress 6.8.12
6.8.8
Fixed in WordPress 6.8.12
6.8.7
Fixed in WordPress 6.8.12
6.8.6
Fixed in WordPress 6.8.12
6.8.5
Fixed in WordPress 6.8.12
6.8.4
Fixed in WordPress 6.8.12
6.8.3
Fixed in WordPress 6.8.12
6.8.2
Fixed in WordPress 6.8.12
6.8.1
Fixed in WordPress 6.8.12
6.8
Fixed in WordPress 6.8.12
6.9.10
Fixed in WordPress 6.9.11
6.9.9
Fixed in WordPress 6.9.11
6.9.8
Fixed in WordPress 6.9.11
6.9.7
Fixed in WordPress 6.9.11
6.9.6
Fixed in WordPress 6.9.11
6.9.5
Fixed in WordPress 6.9.11
6.9.4
Fixed in WordPress 6.9.11
6.9.3
Fixed in WordPress 6.9.11
6.9.2
Fixed in WordPress 6.9.11
6.9.1
Fixed in WordPress 6.9.11
6.9
Fixed in WordPress 6.9.11
7.0.7
Fixed in WordPress 7.0.8
7.0.6
Fixed in WordPress 7.0.8
7.0.5
Fixed in WordPress 7.0.8
7.0.4
Fixed in WordPress 7.0.8
7.0.3
Fixed in WordPress 7.0.8
7.0.2
Fixed in WordPress 7.0.8
7.0.1
Fixed in WordPress 7.0.8
7.0
Fixed in WordPress 7.0.8
7.1.3
Fixed in WordPress 7.1.4
7.1.2
Fixed in WordPress 7.1.4
7.1.1
Fixed in WordPress 7.1.4
7.1
Fixed in WordPress 7.1.4

Affects Plugins

Plugin icon
gutenberg
Fixed in 24.3.0

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-4/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
Yes
WPVDB ID
d11b2d95-b5a9-4531-af3f-bffa093cb41a

Timeline

Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 17 hours ago)
Last Updated
2026-10-29 (about 17 hours ago)

Other

Published
Title
Published
2026-04-09
Title
Webling < 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter
Published
2025-05-19
Title
Ultimate Blocks < 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-02-13
Title
Prezi Embedder <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-12-17
Title
ScanCircle < 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-05-31
Title
WP Logs Book <= 1.0.1 - Unauthenticated Stored XSS