WordPress Vulnerabilities
WP 6.7 - 7.1.3 - Contributor+ Stored XSS via Categories Block
Description
WordPress does not properly sanitise a block attribute in the Categories block in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks. This also affects the Gutenberg plugin.
Affects WordPress
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.7.11
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.8.12
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.1.4
Fixed in WordPress 7.1.4
Fixed in WordPress 7.1.4
Fixed in WordPress 7.1.4 Affects Plugins
Fixed in 24.3.0 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Ben Bidner
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 17 hours ago)
Last Updated
2026-10-29 (about 17 hours ago)
