All vulnerabilities

WordPress core

GHSA-mgvw-845h-9qgq

A theme that supports custom-header and does not register an admin-preview-callback is vulnerable to stored XSS

Severity: Low
Published: 18 Sept 2026
Last changed: 18 Sept 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 6.5.11, 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5
Sources: WordPress

Affected software

Software Affected versions

WordPressWordPress core · cpe:a:wordpress:wordpress

Version 7.1.0
From 7.0.0 before 7.0.5
From 6.9.0 before 6.9.8
From 6.8.0 before 6.8.9

All 25 release lines

From 4.7.0 before 4.7.36
From 4.8.0 before 4.8.31
From 4.9.0 before 4.9.32
From 5.0.0 before 5.0.28
From 5.1.0 before 5.1.25
From 5.2.0 before 5.2.27
From 5.3.0 before 5.3.24
From 5.4.0 before 5.4.22
From 5.5.0 before 5.5.21
From 5.6.0 before 5.6.20
From 5.7.0 before 5.7.18
From 5.8.0 before 5.8.16
From 5.9.0 before 5.9.17
From 6.0.0 before 6.0.15
From 6.1.0 before 6.1.13
From 6.2.0 before 6.2.12
From 6.3.0 before 6.3.11
From 6.4.0 before 6.4.11
From 6.5.0 before 6.5.11
From 6.6.0 before 6.6.8
From 6.7.0 before 6.7.8
From 6.8.0 before 6.8.9
From 6.9.0 before 6.9.8
From 7.0.0 before 7.0.5
Version 7.1.0

References

GitHub Advisory Database https://github.com/advisories/GHSA-mgvw-845h-9qgq
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-mgvw-845h-9qgq