WordPress Vulnerabilities

WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Event Handler Bindings

Description

WordPress does not sanitise event-handler values bound through Interactivity API directives in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session. This also affects the Gutenberg plugin.

Affects WordPress

6.5.13
Fixed in WordPress 6.5.14
6.5.12
Fixed in WordPress 6.5.14
6.5.11
Fixed in WordPress 6.5.14
6.5.10
Fixed in WordPress 6.5.14
6.5.9
Fixed in WordPress 6.5.14
6.5.8
Fixed in WordPress 6.5.14
6.5.7
Fixed in WordPress 6.5.14
6.5.6
Fixed in WordPress 6.5.14
6.5.5
Fixed in WordPress 6.5.14
6.5.4
Fixed in WordPress 6.5.14
6.5.3
Fixed in WordPress 6.5.14
6.5.2
Fixed in WordPress 6.5.14
6.5
Fixed in WordPress 6.5.14
6.6.10
Fixed in WordPress 6.6.11
6.6.9
Fixed in WordPress 6.6.11
6.6.8
Fixed in WordPress 6.6.11
6.6.7
Fixed in WordPress 6.6.11
6.6.6
Fixed in WordPress 6.6.11
6.6.5
Fixed in WordPress 6.6.11
6.6.4
Fixed in WordPress 6.6.11
6.6.3
Fixed in WordPress 6.6.11
6.6.2
Fixed in WordPress 6.6.11
6.6.1
Fixed in WordPress 6.6.11
6.6
Fixed in WordPress 6.6.11
6.7.10
Fixed in WordPress 6.7.11
6.7.9
Fixed in WordPress 6.7.11
6.7.8
Fixed in WordPress 6.7.11
6.7.7
Fixed in WordPress 6.7.11
6.7.6
Fixed in WordPress 6.7.11
6.7.5
Fixed in WordPress 6.7.11
6.7.4
Fixed in WordPress 6.7.11
6.7.3
Fixed in WordPress 6.7.11
6.7.2
Fixed in WordPress 6.7.11
6.7.1
Fixed in WordPress 6.7.11
6.7
Fixed in WordPress 6.7.11
6.8.11
Fixed in WordPress 6.8.12
6.8.10
Fixed in WordPress 6.8.12
6.8.9
Fixed in WordPress 6.8.12
6.8.8
Fixed in WordPress 6.8.12
6.8.7
Fixed in WordPress 6.8.12
6.8.6
Fixed in WordPress 6.8.12
6.8.5
Fixed in WordPress 6.8.12
6.8.4
Fixed in WordPress 6.8.12
6.8.3
Fixed in WordPress 6.8.12
6.8.2
Fixed in WordPress 6.8.12
6.8.1
Fixed in WordPress 6.8.12
6.8
Fixed in WordPress 6.8.12
6.9.10
Fixed in WordPress 6.9.11
6.9.9
Fixed in WordPress 6.9.11
6.9.8
Fixed in WordPress 6.9.11
6.9.7
Fixed in WordPress 6.9.11
6.9.6
Fixed in WordPress 6.9.11
6.9.5
Fixed in WordPress 6.9.11
6.9.4
Fixed in WordPress 6.9.11
6.9.3
Fixed in WordPress 6.9.11
6.9.2
Fixed in WordPress 6.9.11
6.9.1
Fixed in WordPress 6.9.11
6.9
Fixed in WordPress 6.9.11
7.0.7
Fixed in WordPress 7.0.8
7.0.6
Fixed in WordPress 7.0.8
7.0.5
Fixed in WordPress 7.0.8
7.0.4
Fixed in WordPress 7.0.8
7.0.3
Fixed in WordPress 7.0.8
7.0.2
Fixed in WordPress 7.0.8
7.0.1
Fixed in WordPress 7.0.8
7.0
Fixed in WordPress 7.0.8
7.1.3
Fixed in WordPress 7.1.4
7.1.2
Fixed in WordPress 7.1.4
7.1.1
Fixed in WordPress 7.1.4
7.1
Fixed in WordPress 7.1.4

Affects Plugins

Plugin icon
gutenberg
Fixed in 24.3.0

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-4/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Jon Surrell
Verified
Yes
WPVDB ID
e9313877-54c3-4da0-8141-1a28aea834c1

Timeline

Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 17 hours ago)
Last Updated
2026-10-29 (about 17 hours ago)

Other

Published
Title
Published
2024-05-17
Title
ShopLentor < 2.8.8 - Contributor+ Stored XSS
Published
2016-02-02
Title
eShop - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2023-12-23
Title
Colibri Page Builder < 1.0.240 - Contributor+ Stored XSS
Published
2025-10-03
Title
WP Photo Album Plus < 9.0.11.007 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload
Published
2024-03-28
Title
WordPress Page Builder – Zion Builder < 3.6.10 - Authenticated (Editor+) Stored Cross-Site Scripting