WordPress Vulnerabilities

WP 5.0 - 7.1.3 - Contributor+ Stored XSS via Customizer Selective Refresh

Description

WordPress does not safely handle a stored selector value during Customizer selective refresh in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks in an administrator's Customizer session on sites using a classic theme.

Affects WordPress

5.0
Fixed in WordPress 5.0.31
5.0.1
Fixed in WordPress 5.0.31
5.0.2
Fixed in WordPress 5.0.31
5.0.3
Fixed in WordPress 5.0.31
5.0.4
Fixed in WordPress 5.0.31
5.0.6
Fixed in WordPress 5.0.31
5.0.7
Fixed in WordPress 5.0.31
5.0.8
Fixed in WordPress 5.0.31
5.0.9
Fixed in WordPress 5.0.31
5.0.10
Fixed in WordPress 5.0.31
5.0.11
Fixed in WordPress 5.0.31
5.0.12
Fixed in WordPress 5.0.31
5.0.13
Fixed in WordPress 5.0.31
5.0.14
Fixed in WordPress 5.0.31
5.0.15
Fixed in WordPress 5.0.31
5.0.16
Fixed in WordPress 5.0.31
5.0.17
Fixed in WordPress 5.0.31
5.0.18
Fixed in WordPress 5.0.31
5.0.19
Fixed in WordPress 5.0.31
5.0.20
Fixed in WordPress 5.0.31
5.0.21
Fixed in WordPress 5.0.31
5.0.22
Fixed in WordPress 5.0.31
5.0.23
Fixed in WordPress 5.0.31
5.0.24
Fixed in WordPress 5.0.31
5.0.25
Fixed in WordPress 5.0.31
5.0.26
Fixed in WordPress 5.0.31
5.0.27
Fixed in WordPress 5.0.31
5.0.28
Fixed in WordPress 5.0.31
5.0.29
Fixed in WordPress 5.0.31
5.0.30
Fixed in WordPress 5.0.31
5.1
Fixed in WordPress 5.1.28
5.1.1
Fixed in WordPress 5.1.28
5.1.2
Fixed in WordPress 5.1.28
5.1.3
Fixed in WordPress 5.1.28
5.1.4
Fixed in WordPress 5.1.28
5.1.5
Fixed in WordPress 5.1.28
5.1.6
Fixed in WordPress 5.1.28
5.1.7
Fixed in WordPress 5.1.28
5.1.8
Fixed in WordPress 5.1.28
5.1.9
Fixed in WordPress 5.1.28
5.1.10
Fixed in WordPress 5.1.28
5.1.11
Fixed in WordPress 5.1.28
5.1.12
Fixed in WordPress 5.1.28
5.1.13
Fixed in WordPress 5.1.28
5.1.14
Fixed in WordPress 5.1.28
5.1.15
Fixed in WordPress 5.1.28
5.1.16
Fixed in WordPress 5.1.28
5.1.17
Fixed in WordPress 5.1.28
5.1.18
Fixed in WordPress 5.1.28
5.1.19
Fixed in WordPress 5.1.28
5.1.20
Fixed in WordPress 5.1.28
5.1.21
Fixed in WordPress 5.1.28
5.1.22
Fixed in WordPress 5.1.28
5.1.23
Fixed in WordPress 5.1.28
5.1.24
Fixed in WordPress 5.1.28
5.1.25
Fixed in WordPress 5.1.28
5.1.26
Fixed in WordPress 5.1.28
5.1.27
Fixed in WordPress 5.1.28
5.2
Fixed in WordPress 5.2.30
5.2.1
Fixed in WordPress 5.2.30
5.2.2
Fixed in WordPress 5.2.30
5.2.3
Fixed in WordPress 5.2.30
5.2.4
Fixed in WordPress 5.2.30
5.2.5
Fixed in WordPress 5.2.30
5.2.6
Fixed in WordPress 5.2.30
5.2.7
Fixed in WordPress 5.2.30
5.2.8
Fixed in WordPress 5.2.30
5.2.9
Fixed in WordPress 5.2.30
5.2.10
Fixed in WordPress 5.2.30
5.2.11
Fixed in WordPress 5.2.30
5.2.12
Fixed in WordPress 5.2.30
5.2.13
Fixed in WordPress 5.2.30
5.2.14
Fixed in WordPress 5.2.30
5.2.15
Fixed in WordPress 5.2.30
5.2.16
Fixed in WordPress 5.2.30
5.2.17
Fixed in WordPress 5.2.30
5.2.18
Fixed in WordPress 5.2.30
5.2.19
Fixed in WordPress 5.2.30
5.2.20
Fixed in WordPress 5.2.30
5.2.21
Fixed in WordPress 5.2.30
5.2.22
Fixed in WordPress 5.2.30
5.2.23
Fixed in WordPress 5.2.30
5.2.24
Fixed in WordPress 5.2.30
5.2.25
Fixed in WordPress 5.2.30
5.2.26
Fixed in WordPress 5.2.30
5.2.27
Fixed in WordPress 5.2.30
5.2.28
Fixed in WordPress 5.2.30
5.2.29
Fixed in WordPress 5.2.30
5.3
Fixed in WordPress 5.3.27
5.3.1
Fixed in WordPress 5.3.27
5.3.2
Fixed in WordPress 5.3.27
5.3.3
Fixed in WordPress 5.3.27
5.3.4
Fixed in WordPress 5.3.27
5.3.5
Fixed in WordPress 5.3.27
5.3.6
Fixed in WordPress 5.3.27
5.3.7
Fixed in WordPress 5.3.27
5.3.8
Fixed in WordPress 5.3.27
5.3.9
Fixed in WordPress 5.3.27
5.3.10
Fixed in WordPress 5.3.27
5.3.11
Fixed in WordPress 5.3.27
5.3.12
Fixed in WordPress 5.3.27
5.3.13
Fixed in WordPress 5.3.27
5.3.14
Fixed in WordPress 5.3.27
5.3.15
Fixed in WordPress 5.3.27
5.3.16
Fixed in WordPress 5.3.27
5.3.17
Fixed in WordPress 5.3.27
5.3.18
Fixed in WordPress 5.3.27
5.3.19
Fixed in WordPress 5.3.27
5.3.20
Fixed in WordPress 5.3.27
5.3.21
Fixed in WordPress 5.3.27
5.3.22
Fixed in WordPress 5.3.27
5.3.23
Fixed in WordPress 5.3.27
5.3.24
Fixed in WordPress 5.3.27
5.3.25
Fixed in WordPress 5.3.27
5.3.26
Fixed in WordPress 5.3.27
5.4
Fixed in WordPress 5.4.25
5.4.1
Fixed in WordPress 5.4.25
5.4.2
Fixed in WordPress 5.4.25
5.4.3
Fixed in WordPress 5.4.25
5.4.4
Fixed in WordPress 5.4.25
5.4.5
Fixed in WordPress 5.4.25
5.4.6
Fixed in WordPress 5.4.25
5.4.7
Fixed in WordPress 5.4.25
5.4.8
Fixed in WordPress 5.4.25
5.4.9
Fixed in WordPress 5.4.25
5.4.10
Fixed in WordPress 5.4.25
5.4.11
Fixed in WordPress 5.4.25
5.4.12
Fixed in WordPress 5.4.25
5.4.13
Fixed in WordPress 5.4.25
5.4.14
Fixed in WordPress 5.4.25
5.4.15
Fixed in WordPress 5.4.25
5.4.16
Fixed in WordPress 5.4.25
5.4.17
Fixed in WordPress 5.4.25
5.4.18
Fixed in WordPress 5.4.25
5.4.19
Fixed in WordPress 5.4.25
5.4.20
Fixed in WordPress 5.4.25
5.4.21
Fixed in WordPress 5.4.25
5.4.22
Fixed in WordPress 5.4.25
5.4.23
Fixed in WordPress 5.4.25
5.4.24
Fixed in WordPress 5.4.25
5.5
Fixed in WordPress 5.5.24
5.5.1
Fixed in WordPress 5.5.24
5.5.2
Fixed in WordPress 5.5.24
5.5.3
Fixed in WordPress 5.5.24
5.5.4
Fixed in WordPress 5.5.24
5.5.5
Fixed in WordPress 5.5.24
5.5.6
Fixed in WordPress 5.5.24
5.5.7
Fixed in WordPress 5.5.24
5.5.8
Fixed in WordPress 5.5.24
5.5.9
Fixed in WordPress 5.5.24
5.5.10
Fixed in WordPress 5.5.24
5.5.11
Fixed in WordPress 5.5.24
5.5.12
Fixed in WordPress 5.5.24
5.5.13
Fixed in WordPress 5.5.24
5.5.14
Fixed in WordPress 5.5.24
5.5.15
Fixed in WordPress 5.5.24
5.5.16
Fixed in WordPress 5.5.24
5.5.17
Fixed in WordPress 5.5.24
5.5.18
Fixed in WordPress 5.5.24
5.5.19
Fixed in WordPress 5.5.24
5.5.20
Fixed in WordPress 5.5.24
5.5.21
Fixed in WordPress 5.5.24
5.5.22
Fixed in WordPress 5.5.24
5.5.23
Fixed in WordPress 5.5.24
5.6
Fixed in WordPress 5.6.23
5.6.1
Fixed in WordPress 5.6.23
5.6.2
Fixed in WordPress 5.6.23
5.6.3
Fixed in WordPress 5.6.23
5.6.4
Fixed in WordPress 5.6.23
5.6.5
Fixed in WordPress 5.6.23
5.6.6
Fixed in WordPress 5.6.23
5.6.7
Fixed in WordPress 5.6.23
5.6.8
Fixed in WordPress 5.6.23
5.6.9
Fixed in WordPress 5.6.23
5.6.10
Fixed in WordPress 5.6.23
5.6.11
Fixed in WordPress 5.6.23
5.6.12
Fixed in WordPress 5.6.23
5.6.13
Fixed in WordPress 5.6.23
5.6.14
Fixed in WordPress 5.6.23
5.6.15
Fixed in WordPress 5.6.23
5.6.16
Fixed in WordPress 5.6.23
5.6.17
Fixed in WordPress 5.6.23
5.6.18
Fixed in WordPress 5.6.23
5.6.19
Fixed in WordPress 5.6.23
5.6.20
Fixed in WordPress 5.6.23
5.6.21
Fixed in WordPress 5.6.23
5.6.22
Fixed in WordPress 5.6.23
5.7
Fixed in WordPress 5.7.21
5.7.1
Fixed in WordPress 5.7.21
5.7.2
Fixed in WordPress 5.7.21
5.7.3
Fixed in WordPress 5.7.21
5.7.4
Fixed in WordPress 5.7.21
5.7.5
Fixed in WordPress 5.7.21
5.7.6
Fixed in WordPress 5.7.21
5.7.7
Fixed in WordPress 5.7.21
5.7.8
Fixed in WordPress 5.7.21
5.7.9
Fixed in WordPress 5.7.21
5.7.10
Fixed in WordPress 5.7.21
5.7.11
Fixed in WordPress 5.7.21
5.7.12
Fixed in WordPress 5.7.21
5.7.13
Fixed in WordPress 5.7.21
5.7.14
Fixed in WordPress 5.7.21
5.7.15
Fixed in WordPress 5.7.21
5.7.16
Fixed in WordPress 5.7.21
5.7.17
Fixed in WordPress 5.7.21
5.7.18
Fixed in WordPress 5.7.21
5.7.19
Fixed in WordPress 5.7.21
5.7.20
Fixed in WordPress 5.7.21
5.8
Fixed in WordPress 5.8.19
5.8.1
Fixed in WordPress 5.8.19
5.8.2
Fixed in WordPress 5.8.19
5.8.3
Fixed in WordPress 5.8.19
5.8.4
Fixed in WordPress 5.8.19
5.8.5
Fixed in WordPress 5.8.19
5.8.6
Fixed in WordPress 5.8.19
5.8.7
Fixed in WordPress 5.8.19
5.8.8
Fixed in WordPress 5.8.19
5.8.9
Fixed in WordPress 5.8.19
5.8.10
Fixed in WordPress 5.8.19
5.8.11
Fixed in WordPress 5.8.19
5.8.12
Fixed in WordPress 5.8.19
5.8.13
Fixed in WordPress 5.8.19
5.8.14
Fixed in WordPress 5.8.19
5.8.15
Fixed in WordPress 5.8.19
5.8.16
Fixed in WordPress 5.8.19
5.8.17
Fixed in WordPress 5.8.19
5.8.18
Fixed in WordPress 5.8.19
5.9
Fixed in WordPress 5.9.20
5.9.1
Fixed in WordPress 5.9.20
5.9.2
Fixed in WordPress 5.9.20
5.9.3
Fixed in WordPress 5.9.20
5.9.4
Fixed in WordPress 5.9.20
5.9.5
Fixed in WordPress 5.9.20
5.9.6
Fixed in WordPress 5.9.20
5.9.7
Fixed in WordPress 5.9.20
5.9.8
Fixed in WordPress 5.9.20
5.9.9
Fixed in WordPress 5.9.20
5.9.10
Fixed in WordPress 5.9.20
5.9.11
Fixed in WordPress 5.9.20
5.9.12
Fixed in WordPress 5.9.20
5.9.13
Fixed in WordPress 5.9.20
5.9.14
Fixed in WordPress 5.9.20
5.9.15
Fixed in WordPress 5.9.20
5.9.16
Fixed in WordPress 5.9.20
5.9.17
Fixed in WordPress 5.9.20
5.9.18
Fixed in WordPress 5.9.20
5.9.19
Fixed in WordPress 5.9.20
6.0
Fixed in WordPress 6.0.18
6.0.1
Fixed in WordPress 6.0.18
6.0.2
Fixed in WordPress 6.0.18
6.0.3
Fixed in WordPress 6.0.18
6.0.4
Fixed in WordPress 6.0.18
6.0.5
Fixed in WordPress 6.0.18
6.0.6
Fixed in WordPress 6.0.18
6.0.7
Fixed in WordPress 6.0.18
6.0.8
Fixed in WordPress 6.0.18
6.0.9
Fixed in WordPress 6.0.18
6.0.10
Fixed in WordPress 6.0.18
6.0.11
Fixed in WordPress 6.0.18
6.0.12
Fixed in WordPress 6.0.18
6.0.13
Fixed in WordPress 6.0.18
6.0.14
Fixed in WordPress 6.0.18
6.0.15
Fixed in WordPress 6.0.18
6.0.16
Fixed in WordPress 6.0.18
6.0.17
Fixed in WordPress 6.0.18
6.1
Fixed in WordPress 6.1.16
6.1.1
Fixed in WordPress 6.1.16
6.1.2
Fixed in WordPress 6.1.16
6.1.3
Fixed in WordPress 6.1.16
6.1.4
Fixed in WordPress 6.1.16
6.1.5
Fixed in WordPress 6.1.16
6.1.6
Fixed in WordPress 6.1.16
6.1.7
Fixed in WordPress 6.1.16
6.1.8
Fixed in WordPress 6.1.16
6.1.9
Fixed in WordPress 6.1.16
6.1.10
Fixed in WordPress 6.1.16
6.1.11
Fixed in WordPress 6.1.16
6.1.12
Fixed in WordPress 6.1.16
6.1.13
Fixed in WordPress 6.1.16
6.1.14
Fixed in WordPress 6.1.16
6.1.15
Fixed in WordPress 6.1.16
6.2
Fixed in WordPress 6.2.15
6.2.1
Fixed in WordPress 6.2.15
6.2.2
Fixed in WordPress 6.2.15
6.2.3
Fixed in WordPress 6.2.15
6.2.4
Fixed in WordPress 6.2.15
6.2.5
Fixed in WordPress 6.2.15
6.2.6
Fixed in WordPress 6.2.15
6.2.7
Fixed in WordPress 6.2.15
6.2.8
Fixed in WordPress 6.2.15
6.2.9
Fixed in WordPress 6.2.15
6.2.10
Fixed in WordPress 6.2.15
6.2.11
Fixed in WordPress 6.2.15
6.2.12
Fixed in WordPress 6.2.15
6.2.13
Fixed in WordPress 6.2.15
6.2.14
Fixed in WordPress 6.2.15
6.3
Fixed in WordPress 6.3.14
6.3.1
Fixed in WordPress 6.3.14
6.3.2
Fixed in WordPress 6.3.14
6.3.3
Fixed in WordPress 6.3.14
6.3.4
Fixed in WordPress 6.3.14
6.3.5
Fixed in WordPress 6.3.14
6.3.6
Fixed in WordPress 6.3.14
6.3.7
Fixed in WordPress 6.3.14
6.3.8
Fixed in WordPress 6.3.14
6.3.9
Fixed in WordPress 6.3.14
6.3.10
Fixed in WordPress 6.3.14
6.3.11
Fixed in WordPress 6.3.14
6.3.12
Fixed in WordPress 6.3.14
6.3.13
Fixed in WordPress 6.3.14
6.4
Fixed in WordPress 6.4.14
6.4.1
Fixed in WordPress 6.4.14
6.4.2
Fixed in WordPress 6.4.14
6.4.3
Fixed in WordPress 6.4.14
6.4.4
Fixed in WordPress 6.4.14
6.4.5
Fixed in WordPress 6.4.14
6.4.6
Fixed in WordPress 6.4.14
6.4.7
Fixed in WordPress 6.4.14
6.4.8
Fixed in WordPress 6.4.14
6.4.9
Fixed in WordPress 6.4.14
6.4.10
Fixed in WordPress 6.4.14
6.4.11
Fixed in WordPress 6.4.14
6.4.12
Fixed in WordPress 6.4.14
6.4.13
Fixed in WordPress 6.4.14
6.5
Fixed in WordPress 6.5.14
6.5.2
Fixed in WordPress 6.5.14
6.5.3
Fixed in WordPress 6.5.14
6.5.4
Fixed in WordPress 6.5.14
6.5.5
Fixed in WordPress 6.5.14
6.5.6
Fixed in WordPress 6.5.14
6.5.7
Fixed in WordPress 6.5.14
6.5.8
Fixed in WordPress 6.5.14
6.5.9
Fixed in WordPress 6.5.14
6.5.10
Fixed in WordPress 6.5.14
6.5.11
Fixed in WordPress 6.5.14
6.5.12
Fixed in WordPress 6.5.14
6.5.13
Fixed in WordPress 6.5.14
6.6
Fixed in WordPress 6.6.11
6.6.1
Fixed in WordPress 6.6.11
6.6.2
Fixed in WordPress 6.6.11
6.6.3
Fixed in WordPress 6.6.11
6.6.4
Fixed in WordPress 6.6.11
6.6.5
Fixed in WordPress 6.6.11
6.6.6
Fixed in WordPress 6.6.11
6.6.7
Fixed in WordPress 6.6.11
6.6.8
Fixed in WordPress 6.6.11
6.6.9
Fixed in WordPress 6.6.11
6.6.10
Fixed in WordPress 6.6.11
6.7
Fixed in WordPress 6.7.11
6.7.1
Fixed in WordPress 6.7.11
6.7.2
Fixed in WordPress 6.7.11
6.7.3
Fixed in WordPress 6.7.11
6.7.4
Fixed in WordPress 6.7.11
6.7.5
Fixed in WordPress 6.7.11
6.7.6
Fixed in WordPress 6.7.11
6.7.7
Fixed in WordPress 6.7.11
6.7.8
Fixed in WordPress 6.7.11
6.7.9
Fixed in WordPress 6.7.11
6.7.10
Fixed in WordPress 6.7.11
6.8
Fixed in WordPress 6.8.12
6.8.1
Fixed in WordPress 6.8.12
6.8.2
Fixed in WordPress 6.8.12
6.8.3
Fixed in WordPress 6.8.12
6.8.4
Fixed in WordPress 6.8.12
6.8.5
Fixed in WordPress 6.8.12
6.8.6
Fixed in WordPress 6.8.12
6.8.7
Fixed in WordPress 6.8.12
6.8.8
Fixed in WordPress 6.8.12
6.8.9
Fixed in WordPress 6.8.12
6.8.10
Fixed in WordPress 6.8.12
6.8.11
Fixed in WordPress 6.8.12
6.9
Fixed in WordPress 6.9.11
6.9.1
Fixed in WordPress 6.9.11
6.9.2
Fixed in WordPress 6.9.11
6.9.3
Fixed in WordPress 6.9.11
6.9.4
Fixed in WordPress 6.9.11
6.9.5
Fixed in WordPress 6.9.11
6.9.6
Fixed in WordPress 6.9.11
6.9.7
Fixed in WordPress 6.9.11
6.9.8
Fixed in WordPress 6.9.11
6.9.9
Fixed in WordPress 6.9.11
6.9.10
Fixed in WordPress 6.9.11
7.0
Fixed in WordPress 7.0.8
7.0.1
Fixed in WordPress 7.0.8
7.0.2
Fixed in WordPress 7.0.8
7.0.3
Fixed in WordPress 7.0.8
7.0.4
Fixed in WordPress 7.0.8
7.0.5
Fixed in WordPress 7.0.8
7.0.6
Fixed in WordPress 7.0.8
7.0.7
Fixed in WordPress 7.0.8
7.1
Fixed in WordPress 7.1.4
7.1.1
Fixed in WordPress 7.1.4
7.1.2
Fixed in WordPress 7.1.4
7.1.3
Fixed in WordPress 7.1.4

References

URL
https://wordpress.org/news/2026/10/wordpress-7-1-4/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
Yes
WPVDB ID
ef799677-d0a7-4310-992f-f2b1c59510b2

Timeline

Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 18 hours ago)
Last Updated
2026-10-29 (about 18 hours ago)

Other

Published
Title
Published
2024-07-10
Title
WP Travel Engine < 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-12-11
Title
Primary Addon for Elementor < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-08
Title
Semantic Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-04-11
Title
Advanced iFrame < 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2025-04-09
Title
MapSVG Lite < 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting