EUVD-2026-82657
GHSA-2pgq-4jch-68j8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public comment form (unauthenticated)
-
DeliverySubmit crafted comment payload
-
ExploitBypass approval, comment stored/rendered
-
ExecutionVictim views page (UI:R)
-
PersistScript executes in victim/admin browser
-
ImpactSession context abuse in site origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against a DEFAULT WordPress installation via the public comment feature: comment moderation is disabled by default and the requirement that a commenter have a previously approved comment can be bypassed, so an unauthenticated attacker can get a payload stored and rendered without prior standing. The primary limiting factor is user interaction (UI:R) - the injected DOM-based script only executes when a visitor or administrator subsequently views the affected page/comment; it also depends on the site running an unpatched core version in the listed ranges (any branch from 4.7 through 7.1 below the fixed releases, e.g. 7.1 before 7.1.1). No authentication and no non-default setting are required. |
| Impact | This is a genuine priority despite mid-range CVSS numerics. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) describes a network-reachable, low-complexity, unauthenticated flaw whose only real gate is user interaction (UI:R - a victim must view the malicious content). The decisive amplifier is the description's explicit statement that the unauthenticated stored XSS is reproducible on a DEFAULT WordPress installation, because comment moderation is off by default and the 'previously-approved-commenter' requirement can be bypassed - so no non-default configuration is needed to weaponize it. No EPSS score, KEV listing, POC flag, or SSVC decision data was provided in the input, so exploitation-likelihood cannot be quantified and there is no confirmed active exploitation. Countering the raw score: this is DOM-based XSS with C:L/I:L/A:L (partial, not total impact) and it fires in the browser of whoever views the injected content rather than granting direct server compromise; the A:L availability impact is arguably generous for XSS. Net: treat as a high-urgency patch because the affected product is ubiquitous and exploitation works against stock installs, not because active exploitation is confirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a blog comment containing a crafted payload to a stock WordPress site; because comment moderation is disabled by default and the prior-approval check can be bypassed, the comment is rendered. When a site visitor or a logged-in administrator later views the page/comment, the DOM-based script executes in their browser session in the site's origin. No public exploit code was identified at time of analysis, but the flaw is described as reproducible on a default installation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Unauthenticated stored cross-site scripting in WordPress core allows an attacker to plant a DOM-based script payload through the public comment feature and have it execute in the browser of any visitor or administrator who later views the affected page. The flaw is reachable on a default installation, because comment moderation is disabled by default and the requirement that a commenter have a previously approved comment can be bypassed; impact is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the injected script only fires once someone opens the affected content. Every core branch from 4.7 through 7.1 below its fixed maintenance release is affected, and at time of analysis no public exploit code was identified, though the low skill floor and the default-configuration reachability make it a genuine patching priority.
RemediationAI
Vendor-released patch: upgrade WordPress core to 7.1.1, the fixed release identified in the vendor's security and maintenance notice (https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/), and consult that advisory plus https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve to confirm the equivalent fixed version for sites pinned to an older branch, since the vulnerability spans 4.7 through 7.1 and every older line needs its own updated build. Where an immediate upgrade is not possible, enable comment moderation under Settings > Discussion so that no comment body is published until a human approves it, accepting the operational cost of a moderation queue and delayed legitimate comments, and additionally enable the 'comment author must have a previously approved comment' option so the documented bypass is no longer sufficient on its own; note that moderation reduces but does not fully eliminate risk, because payloads still reach the moderation interface and an administrator previewing a queued comment can trigger execution, so admins should avoid previewing untrusted comments in a privileged session. Sites that do not use comments should disable them site-wide or close comments on all existing posts, which removes the delivery vector entirely at the cost of losing legitimate discussion, and front-end or WAF filtering of comment submissions can be layered on as a stopgap, though client-side sanitization should be treated as compensating only and not as a substitute for the core update. Because exploitation requires a victim to view the injected content, restricting comment access to registered users or temporarily pausing public commenting during the patch window are low-cost interim measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of input during web page generation, manifesting here as a DOM-based variant rather than the more familiar reflected or stored server-side pattern. Instead of the malicious payload being written into the rendered HTML by PHP, attacker-controlled comment input reaches a client-side sink and is processed by JavaScript in the victim's browser, which is why server-side output escaping alone does not reliably contain it and why the payload survives being stored and later retrieved. The attack surface is the standard WordPress comment pipeline: comment moderation is off by default, and the 'comment author must have a previously approved comment' restriction can be circumvented, so an unauthenticated party can get content into the store and have it rendered without any prior trust relationship. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N records network reachability, no privileges required, required user interaction, and a scope change (S:C) reflecting that code executes in the context of the victim's session rather than the vulnerable component itself, with limited rather than high confidentiality and integrity impact and no availability impact. CPE entries consistently identify the affected component as cpe:2.3:a:automattic:wordpress across ten separate version ranges.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network comment injection (PR:N/AV:N/AC:L) firing only when a victim views content (UI:R), crossing into the victim's browser context (S:C) with partial C/I; A:N as XSS rarely impacts availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS.
This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.
The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.
Technical POC Analysis
CWE-79, specifically a DOM-based cross-site scripting flaw in WordPress core's comment rendering path.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
WordPress core, which underpins a substantial share of externally facing websites, carries an unauthenticated stored cross-site scripting flaw that allows an attacker to plant a script payload through the public comment feature and have it execute in the browser of any visitor or administrator who later views the affected page. The issue is reachable on a default installation, so any site running core branches 4.7 through 7.1 without additional hardening is exposed to administrative session theft and unauthorized site changes that require no prior access to the organization. No vendor-released patch was identified at time of analysis, and while no public exploit code has been identified, exploitation requires only user interaction with the affected page, leaving exposure open-ended until mitigation is deployed.
No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Interim mitigations: disable or moderate the public comment feature so no unapproved comment content renders to visitors; deploy WAF/virtual patching rules that inspect and block script payloads in comment submission and rendering paths; sanitize and purge existing stored comments; enforce a strict Content Security Policy; isolate and restrict administrator sessions (dedicated browser profiles, network restrictions, short session lifetimes) to limit the value of a stolen session; and monitor the vendor advisory channel for the fixed maintenance release covering branches 4.7 through 7.1, applying it as soon as it is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB