WordPress 7.0.2 Vulnerabilities

Version released on 2026-07-17

Download tar
Download zip
Published
Title
Fixed in
CVSS
Published
2026-10-29
Title
WP 4.9 - 7.1.3 - Editor+ Stored XSS via Data Erasure Requests
Fixed in
Fixed in 7.0.8
CVSS
3.5 (low)
Published
2026-10-29
Title
WP < 7.1.4 - Stored XSS in Multisite Network Users Screen (Defense-in-Depth)
Fixed in
Fixed in 7.0.8
CVSS
3.1 (low)
Published
2026-10-29
Title
WP 6.9 - 7.1.3 - Post Note Disclosure, Modification and Deletion via Comment Moderation Capability
Fixed in
Fixed in 7.0.8
CVSS
3.8 (low)
Published
2026-10-29
Title
WP < 7.1.4 - Unauthenticated RCE During Core Update
Fixed in
Fixed in 7.0.8
CVSS
8.1 (high)
Published
2026-10-29
Title
WP 5.0 - 7.1.3 - Contributor+ Stored XSS via Customizer Selective Refresh
Fixed in
Fixed in 7.0.8
CVSS
6.4 (medium)
Published
2026-10-29
Title
WP 4.9 - 7.1.3 - Unauthenticated Customizer Changeset Disclosure
Fixed in
Fixed in 7.0.8
CVSS
5.3 (medium)
Published
2026-10-29
Title
WP 6.7 - 7.1.3 - Contributor+ Stored XSS via Categories Block
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Playlist and Image Blocks
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Context Namespace Pollution
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Bind Directive Prototype Pollution
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Style Directive Object Write
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.6 - 7.1.3 - Contributor+ Stored XSS via Script Module Data Shadowing
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Prototype-Chain Property Injection
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.5 - 7.1.3 - Contributor+ Stored DoS via Interactivity API Bindings
Fixed in
Fixed in 7.0.8
CVSS
2.4 (low)
Published
2026-10-29
Title
WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API href Binding
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.6 - 7.1.3 - Author+ Stored XSS via Interactivity Router
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Event Handler Bindings
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 5.9 - 7.1.3 - Contributor+ Stored XSS via Comments Pagination Previous Block
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 5.0 - 7.1.3 - Contributor+ Stored XSS via Block Markup Parsing
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 5.9 - 7.1.3 - Contributor+ Stored XSS via Comments Pagination Next Block
Fixed in
Fixed in 7.0.8
CVSS
6.8 (medium)
Published
2026-10-29
Title
WP 6.6 - 7.1.3 - Contributor+ KSES Restriction Bypass via Interactivity API Object Bindings
Fixed in
Fixed in 7.0.8
CVSS
6.4 (medium)
Published
2026-10-06
Title
WP < 7.1.3 - Action Injection via Post Status Transition Dynamic Hooks
Fixed in
Fixed in 7.0.7
CVSS
3.3 (low)
Published
2026-10-06
Title
WP < 7.1.3 - Contributor+ Stored XSS via Imgur Embed
Fixed in
Fixed in 7.0.7
CVSS
6.8 (medium)
Published
2026-10-06
Title
WP < 7.1.3 - Unauthenticated Private Post Comment Disclosure via RSS Feed
Fixed in
Fixed in 7.0.7
CVSS
5.3 (medium)
Published
2026-10-06
Title
WP < 7.1.3 - Author+ SQLi via WXR Export
Fixed in
Fixed in 7.0.7
CVSS
5.4 (medium)
Published
2026-10-06
Title
WP < 7.1.3 - Author+ Sticky Post via REST API
Fixed in
Fixed in 7.0.7
CVSS
2.7 (low)
Published
2026-10-06
Title
WP < 7.1.3 - Contributor+ DoS via Block Editor URL Details
Fixed in
Fixed in 7.0.7
CVSS
4.9 (medium)
Published
2026-10-06
Title
WP < 7.1.3 - Unauthenticated Stored XSS via Comment Moderation
Fixed in
Fixed in 7.0.7
CVSS
8.8 (high)
Published
2026-09-22
Title
WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution
Fixed in
Fixed in 7.0.6
CVSS
8.1 (high)
Published
2026-09-17
Title
WP < 7.1.1 - Unauthenticated Stored XSS via Comments
Fixed in
Fixed in 7.0.5
CVSS
8.8 (high)
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ Stored XSS via Custom Header
Fixed in
Fixed in 7.0.5
CVSS
3.5 (low)
Published
2026-09-17
Title
WP < 7.1.1 - Theme Installation via CSRF
Fixed in
Fixed in 7.0.5
CVSS
4.3 (medium)
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ Network-Wide Plugin Activation on Multisite
Fixed in
Fixed in 7.0.5
CVSS
2.2 (low)
Published
2026-09-17
Title
WP < 7.1.1 - Author+ Path Traversal via Templates REST API
Fixed in
Fixed in 7.0.5
CVSS
4.1 (medium)
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ CSS Injection on Multisite via XML-RPC
Fixed in
Fixed in 7.0.5
CVSS
5.5 (medium)
Published
2026-09-17
Title
WP < 7.1.1 - Contributor+ Arbitrary Post Modification
Fixed in
Fixed in 7.0.5
CVSS
4.9 (medium)
Published
2026-09-17
Title
WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen
Fixed in
Fixed in 7.0.5
CVSS
2.2 (low)
Published
2026-09-17
Title
WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure
Fixed in
Fixed in 7.0.5
CVSS
2.7 (low)
Published
2026-09-17
Title
WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API
Fixed in
Fixed in 7.0.5
CVSS
2.7 (low)
Published
2026-08-12
Title
WP < 7.0.4 - Author+ RCE via PDF Upload
Fixed in
Fixed in 7.0.4
CVSS
6.6 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Subscriber+ Email Change Confirmation Bypass
Fixed in
Fixed in 7.0.3
CVSS
4.3 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Blind SSRF
Fixed in
Fixed in 7.0.3
CVSS
5.8 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Internal Note Disclosure via Comment Feeds
Fixed in
Fixed in 7.0.3
CVSS
5.3 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Author+ CSS Injection
Fixed in
Fixed in 7.0.3
CVSS
5.5 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Non-Public Post Type Slug Disclosure
Fixed in
Fixed in 7.0.3
CVSS
5.3 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS in Quick Edits
Fixed in
Fixed in 7.0.3
CVSS
6.8 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Subscriber+ Arbitrary Site Creation on Multisite
Fixed in
Fixed in 7.0.3
CVSS
4.3 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS via Emoji Settings Element
Fixed in
Fixed in 7.0.3
CVSS
6.8 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Reflected XSS
Fixed in
Fixed in 7.0.3
CVSS
7.1 (high)
Published
2026-08-06
Title
WP 7.0.x - Unauthenticated Password Protected Post Comment Disclosure via Gutenberg Latest Comments Block
Fixed in
Fixed in 7.0.3
CVSS
5.3 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Date Block
Fixed in
Fixed in 7.0.3
CVSS
6.8 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Content Block
Fixed in
Fixed in 7.0.3
CVSS
6.8 (medium)