Improper Encoding or Escaping of Output in WordPress - #VU159337
Published: November 4, 2026
Vulnerability identifier: #VU159337
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-116
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to inject unintended markup into generated HTML.
The vulnerability exists due to improper neutralization of HTML comment-closing sequences in WP_HTML_Tag_Processor's set_modifiable_text() method when processing supplied comment text. A local privileged user can supply specially crafted strings containing abrupt-closing sequences to escape an HTML comment and inject markup, with exploitation requiring user interaction.
The advisory identifies no direct vulnerability in WordPress core or Gutenberg arising from this behavior.
Affected software
WordPress
Remediation
Install security update from vendor's website.
WordPress - addressed in versions 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1