All vulnerabilities

WordPress core

GHSA-j3rg-rwgx-7wx7

Unescaped usernames on the multisite Network Users screens, fixed as a hardening measure

Severity: Low
Published: 29 Oct 2026
Last changed: 29 Oct 2026
Added to UpHeron: 30 Oct 2026
Fixed in: 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4
Sources: WordPress

Affected software

Software Affected versions

WordPressWordPress core · cpe:a:wordpress:wordpress

From 7.1.0 before 7.1.4
From 7.0.0 before 7.0.8
From 6.9.0 before 6.9.11
From 6.8.0 before 6.8.12

All 25 release lines

From 4.7.0 before 4.7.39
From 4.8.0 before 4.8.34
From 4.9.0 before 4.9.35
From 5.0.0 before 5.0.31
From 5.1.0 before 5.1.28
From 5.2.0 before 5.2.30
From 5.3.0 before 5.3.27
From 5.4.0 before 5.4.25
From 5.5.0 before 5.5.24
From 5.6.0 before 5.6.23
From 5.7.0 before 5.7.21
From 5.8.0 before 5.8.19
From 5.9.0 before 5.9.20
From 6.0.0 before 6.0.18
From 6.1.0 before 6.1.16
From 6.2.0 before 6.2.15
From 6.3.0 before 6.3.14
From 6.4.0 before 6.4.14
From 6.5.0 before 6.5.14
From 6.6.0 before 6.6.11
From 6.7.0 before 6.7.11
From 6.8.0 before 6.8.12
From 6.9.0 before 6.9.11
From 7.0.0 before 7.0.8
From 7.1.0 before 7.1.4

References

GitHub Advisory Database https://github.com/advisories/GHSA-j3rg-rwgx-7wx7
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-j3rg-rwgx-7wx7