Bug 2558765 (CVE-2026-114570)
| Summary: | CVE-2026-114570 wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in WordPress. Insufficient escaping of user display names in the Quick Edit feature allows an authenticated user with contributor-level privileges to conduct stored Cross-Site Scripting (XSS) attacks. By submitting malicious scripts, an attacker can cause them to execute within the session of an administrator who views the affected administrative screens, potentially leading to unauthorized administrative actions or session compromise.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2559053, 2559054, 2559055, 2559057, 2559058 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-22 05:44:08 UTC
|