SB2026110245 - Multiple vulnerabilities in WordPress

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110245

SB2026110245 - Multiple vulnerabilities in WordPress

Published: November 2, 2026

Security Bulletin ID SB2026110245
CSH Severity
High
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 8% Medium 8% Low 85%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in the context of the affected website.

The vulnerability exists due to unsafe inherited property lookups in WordPress Interactivity API bindings when processing directives in post content. A remote user can store crafted bindings as a Contributor or higher that reach innerHTML through inherited properties to inject script that executes when the affected content is rendered.


2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to potentially execute arbitrary script in the context of the affected website or cause a denial of service.

The vulnerability exists due to unsafe handling of __proto__ as a directive name in WordPress Interactivity API bindings when processing post content. A remote user can store crafted content containing a __proto__ directive as a Contributor or higher to interfere with binding processing, potentially resulting in stored cross-site scripting or a denial of service.


3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to potentially execute arbitrary script in the context of the affected website or cause a denial of service.

The vulnerability exists due to insufficient restrictions on binding targets in WordPress Interactivity API bindings when resolving internal properties or inherited methods. A remote user can store crafted bindings targeting these properties or methods in post content as a Contributor or higher to interfere with binding processing, potentially resulting in stored cross-site scripting or a denial of service.


4) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to potentially execute arbitrary script in the context of the affected website or cause a denial of service.

The vulnerability exists due to insufficient restrictions on object write targets in WordPress Interactivity API data-wp-style bindings when resolving objects referenced by post content. A remote user can store crafted data-wp-style bindings as a Contributor or higher to write into any resolved object, potentially resulting in stored cross-site scripting or a denial of service.


5) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to manipulate the markup generated by WordPress Image and Playlist blocks.

The vulnerability exists due to improper neutralization of replacement-string metacharacters in the Image and Playlist blocks when building markup from block attributes using preg_replace(). A remote user can supply block attribute values containing backreferences such as $1 to cause captured content to be substituted into the generated markup instead of preserving those values literally.


6) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in a victim's browser in the context of the affected WordPress site.

The vulnerability exists due to format string injection in the WordPress Categories block when passing a user-controlled string to sprintf() as its format string. A remote user can supply a crafted format string to inject script that executes when the affected content is rendered in a victim's browser.


7) Use of Incorrectly-Resolved Name or Reference (CVE-ID: N/A)

CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to replace the data read by a Script Module with data supplied through post content.

The vulnerability exists due to incorrectly resolved element references in WordPress Script Module data handling when post content contains an element whose ID matches a module's data script. A remote user can include an element with a matching ID in a post to substitute the data read by the module.


8) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the browsers of users viewing affected WordPress content.

The vulnerability exists due to missing output escaping in the labels of the Comments Pagination Next, Comments Pagination Previous and Post Navigation Link blocks when rendering post content. A remote user can use Contributor-level or higher permissions to store malicious script in these labels to execute JavaScript in the browsers of users viewing the affected content.


9) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in an administrator's browser within the WordPress Customizer preview.

The vulnerability exists due to improper neutralization of stored markup in WordPress Customizer selective refresh when rendering post content as HTML. A remote user can store specially crafted markup in post content to execute arbitrary JavaScript when an administrator previews the content in the Customizer.


10) Race condition (CVE-ID: N/A)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code remotely.

The vulnerability exists due to a race condition in the WordPress core update process when extracting a complete update package into a predictable directory inside the web-served upgrade folder. A remote attacker can exploit the predictable extraction location during the race window to execute arbitrary code remotely.


11) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose unpublished WordPress Customizer changes.

The vulnerability exists due to improper access control in the WordPress Customizer front-end preview when handling preview requests. A remote attacker can load the newest unpublished changeset without knowing its UUID to view unpublished changes.


12) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read, modify, and delete notes on posts they are not authorized to edit.

The vulnerability exists due to improper authorization in the WordPress note update and delete endpoints when handling requests from custom roles with the moderate_comments capability. A remote user can submit requests targeting notes on posts they cannot edit to gain unauthorized access to those notes and modify or delete them.

No default WordPress role is affected.


13) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary script in an administrator's browser within the WordPress security context.

The vulnerability exists due to improper neutralization of script-containing input in the WordPress personal data erasure requests screen when rendering stored request email fields. A remote privileged user can create a personal data erasure request through XML-RPC with a script in its email field to execute that script when an administrator views the Erase Personal Data screen.


Remediation

Install update from vendor's website.

References