CVE-2026-114570
Description
A flaw was found in WordPress. Insufficient escaping of user display names in the Quick Edit feature allows an authenticated user with contributor-level privileges to conduct stored Cross-Site Scripting (XSS) attacks. By submitting malicious scripts, an attacker can cause them to execute within the session of an administrator who views the affected administrative screens, potentially leading to unauthorized administrative actions or session compromise.
Statement
This vulnerability is rated as having a Moderate severity for Red Hat community distributions because successful exploitation requires authenticated access with contributor privileges or higher, preventing unauthenticated remote abuse. WordPress is not distributed in core Red Hat Enterprise Linux products, being available only through community channels such as EPEL and Fedora. The impact is limited to deployments with large user directories where high-privilege administrators interact with quick-edit management interfaces.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
