Cross-site scripting in WordPress - #VU158598
Published: November 2, 2026
Vulnerability identifier: #VU158598
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in the context of the affected website.
The vulnerability exists due to unsafe inherited property lookups in WordPress Interactivity API bindings when processing directives in post content. A remote user can store crafted bindings as a Contributor or higher that reach innerHTML through inherited properties to inject script that executes when the affected content is rendered.
Affected software
WordPress
Remediation
Install security update from vendor's website.
WordPress - addressed in versions 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4