WordPress Vulnerabilities

WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Playlist and Image Blocks

Description

WordPress does not properly sanitise user-controlled block attributes in the Playlist and Image blocks in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks. This also affects the Gutenberg plugin.

Affects WordPress

6.4.13
Fixed in WordPress 6.4.14
6.4.12
Fixed in WordPress 6.4.14
6.4.11
Fixed in WordPress 6.4.14
6.4.10
Fixed in WordPress 6.4.14
6.4.9
Fixed in WordPress 6.4.14
6.4.8
Fixed in WordPress 6.4.14
6.4.7
Fixed in WordPress 6.4.14
6.4.6
Fixed in WordPress 6.4.14
6.4.5
Fixed in WordPress 6.4.14
6.4.4
Fixed in WordPress 6.4.14
6.4.3
Fixed in WordPress 6.4.14
6.4.2
Fixed in WordPress 6.4.14
6.4.1
Fixed in WordPress 6.4.14
6.4
Fixed in WordPress 6.4.14
6.5.13
Fixed in WordPress 6.5.14
6.5.12
Fixed in WordPress 6.5.14
6.5.11
Fixed in WordPress 6.5.14
6.5.10
Fixed in WordPress 6.5.14
6.5.9
Fixed in WordPress 6.5.14
6.5.8
Fixed in WordPress 6.5.14
6.5.7
Fixed in WordPress 6.5.14
6.5.6
Fixed in WordPress 6.5.14
6.5.5
Fixed in WordPress 6.5.14
6.5.4
Fixed in WordPress 6.5.14
6.5.3
Fixed in WordPress 6.5.14
6.5.2
Fixed in WordPress 6.5.14
6.5
Fixed in WordPress 6.5.14
6.6.10
Fixed in WordPress 6.6.11
6.6.9
Fixed in WordPress 6.6.11
6.6.8
Fixed in WordPress 6.6.11
6.6.7
Fixed in WordPress 6.6.11
6.6.6
Fixed in WordPress 6.6.11
6.6.5
Fixed in WordPress 6.6.11
6.6.4
Fixed in WordPress 6.6.11
6.6.3
Fixed in WordPress 6.6.11
6.6.2
Fixed in WordPress 6.6.11
6.6.1
Fixed in WordPress 6.6.11
6.6
Fixed in WordPress 6.6.11
6.7.10
Fixed in WordPress 6.7.11
6.7.9
Fixed in WordPress 6.7.11
6.7.8
Fixed in WordPress 6.7.11
6.7.7
Fixed in WordPress 6.7.11
6.7.6
Fixed in WordPress 6.7.11
6.7.5
Fixed in WordPress 6.7.11
6.7.4
Fixed in WordPress 6.7.11
6.7.3
Fixed in WordPress 6.7.11
6.7.2
Fixed in WordPress 6.7.11
6.7.1
Fixed in WordPress 6.7.11
6.7
Fixed in WordPress 6.7.11
6.8.11
Fixed in WordPress 6.8.12
6.8.10
Fixed in WordPress 6.8.12
6.8.9
Fixed in WordPress 6.8.12
6.8.8
Fixed in WordPress 6.8.12
6.8.7
Fixed in WordPress 6.8.12
6.8.6
Fixed in WordPress 6.8.12
6.8.5
Fixed in WordPress 6.8.12
6.8.4
Fixed in WordPress 6.8.12
6.8.3
Fixed in WordPress 6.8.12
6.8.2
Fixed in WordPress 6.8.12
6.8.1
Fixed in WordPress 6.8.12
6.8
Fixed in WordPress 6.8.12
6.9.10
Fixed in WordPress 6.9.11
6.9.9
Fixed in WordPress 6.9.11
6.9.8
Fixed in WordPress 6.9.11
6.9.7
Fixed in WordPress 6.9.11
6.9.6
Fixed in WordPress 6.9.11
6.9.5
Fixed in WordPress 6.9.11
6.9.4
Fixed in WordPress 6.9.11
6.9.3
Fixed in WordPress 6.9.11
6.9.2
Fixed in WordPress 6.9.11
6.9.1
Fixed in WordPress 6.9.11
6.9
Fixed in WordPress 6.9.11
7.0.7
Fixed in WordPress 7.0.8
7.0.6
Fixed in WordPress 7.0.8
7.0.5
Fixed in WordPress 7.0.8
7.0.4
Fixed in WordPress 7.0.8
7.0.3
Fixed in WordPress 7.0.8
7.0.2
Fixed in WordPress 7.0.8
7.0.1
Fixed in WordPress 7.0.8
7.0
Fixed in WordPress 7.0.8
7.1.3
Fixed in WordPress 7.1.4
7.1.2
Fixed in WordPress 7.1.4
7.1.1
Fixed in WordPress 7.1.4
7.1
Fixed in WordPress 7.1.4

Affects Plugins

Plugin icon
gutenberg
Fixed in 24.3.0

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-4/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Ben Bidner
Verified
Yes
WPVDB ID
d9a9fd92-7e09-414b-8c1b-6f4b33055200

Timeline

Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 17 hours ago)
Last Updated
2026-10-29 (about 17 hours ago)

Other

Published
Title
Published
2025-01-16
Title
Woo Update Variations In Cart <= 0.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2026-01-04
Title
Form to Chat App <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-07-17
Title
Testimonial Post type <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play Parameter
Published
2022-04-19
Title
Custom TinyMCE Shortcode Button <= 1.1 - Reflected Cross-Site Scripting
Published
2025-09-22
Title
Goracash <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting