Cross-site scripting in WordPress - #VU158606
Published: November 2, 2026
Vulnerability identifier: #VU158606
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in an administrator's browser within the WordPress Customizer preview.
The vulnerability exists due to improper neutralization of stored markup in WordPress Customizer selective refresh when rendering post content as HTML. A remote user can store specially crafted markup in post content to execute arbitrary JavaScript when an administrator previews the content in the Customizer.
Affected software
WordPress
Remediation
Install security update from vendor's website.
WordPress - addressed in versions 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4