All vulnerabilities

WordPress core

CVE-2026-114570

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

Severity: Medium 4.9
Published: 22 Oct 2026
Last changed: 22 Oct 2026
Added to UpHeron: 23 Oct 2026
Sources: CVE Program

Affected software

Software Affected versions

WordPressWordPress core · cna:wordpress foundation|wordpress

From 7.0.0 up to 7.0.2
From 6.9.0 up to 6.9.5
From 6.8.0 up to 6.8.6
From 6.7.0 up to 6.7.5

All 24 release lines

From 4.7.0 up to 4.7.33
From 4.8.0 up to 4.8.28
From 4.9.0 up to 4.9.29
From 5.0.0 up to 5.0.25
From 5.1.0 up to 5.1.22
From 5.2.0 up to 5.2.24
From 5.3.0 up to 5.3.21
From 5.4.0 up to 5.4.19
From 5.5.0 up to 5.5.18
From 5.6.0 up to 5.6.17
From 5.7.0 up to 5.7.15
From 5.8.0 up to 5.8.13
From 5.9.0 up to 5.9.13
From 6.0.0 up to 6.0.12
From 6.1.0 up to 6.1.10
From 6.2.0 up to 6.2.9
From 6.3.0 up to 6.3.8
From 6.4.0 up to 6.4.8
From 6.5.0 up to 6.5.8
From 6.6.0 up to 6.6.5
From 6.7.0 up to 6.7.5
From 6.8.0 up to 6.8.6
From 6.9.0 up to 6.9.5
From 7.0.0 up to 7.0.2

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114570