Use of Incorrectly-Resolved Name or Reference in WordPress - #VU158604
Published: November 2, 2026
Vulnerability identifier: #VU158604
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-706
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to replace the data read by a Script Module with data supplied through post content.
The vulnerability exists due to incorrectly resolved element references in WordPress Script Module data handling when post content contains an element whose ID matches a module's data script. A remote user can include an element with a matching ID in a post to substitute the data read by the module.
Affected software
WordPress
Remediation
Install security update from vendor's website.
WordPress - addressed in versions 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4