Vulnerability feed

Executive summary

WordPress Core is affected by a stored cross-site scripting flaw in Quick Edit, present in all versions up to and including 7.0.2. The advisory says WordPress 7.0.3 bundles several security fixes and recommends updating sites immediately.

Technical summary

The Quick Edit flaw is stored cross-site scripting caused by insufficient escaping of user display names, affecting all versions up to and including 7.0.2. The advisory's release notes list related fixes in 7.0.3 for stored XSS in Quick Edit on sites with many users, and a Contributor+ stored XSS via the Post Content block, among others. The attack vector and exact preconditions for the Quick Edit issue are not stated beyond the reporter credit for large-user sites, and CVSS score is not stated. Fixed version for the Quick Edit issue is 7.0.3 by implication of the release, but the advisory does not explicitly map it, and workarounds are not stated. Backports to older branches are in progress and their versions are not stated. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wordpress.org/news/2026/08/wordpress-7-0-3-release

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Affects

WordPress FoundationWordPressWordPress Foundation WordPressWordPress Core