Cross-site scripting in WordPress - #VU158605
Published: November 2, 2026
Vulnerability identifier: #VU158605
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in the browsers of users viewing affected WordPress content.
The vulnerability exists due to missing output escaping in the labels of the Comments Pagination Next, Comments Pagination Previous and Post Navigation Link blocks when rendering post content. A remote user can use Contributor-level or higher permissions to store malicious script in these labels to execute JavaScript in the browsers of users viewing the affected content.
Affected software
WordPress
Remediation
Install security update from vendor's website.
WordPress - addressed in versions 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4