CVE-2026-114570

7th percentile - higher than 7% of all known CVEs

WordPress Core (all versions up to and including 7.0.2) is vulnerable to stored Cross-Site Scripting via Quick Edit due to insufficient escaping of user display names. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a higher-privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

An attacker with a Contributor account can inject malicious scripts that execute in an administrator's browser, potentially leading to session hijacking or actions performed on behalf of a privileged user. The risk affects sites with a large number of users.

Update WordPress Core to a version later than 7.0.2. Limit the number of elevated-privilege accounts and review user display names.