WordPress Core <= 7.1 — Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data

Overview

Advisory ID

3d59700b-3540-464c-bd27-23bb71f9b082

Product

WordPress wordpress

Affected

≤7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

Weakness

CWE-79 Cross-Site Scripting

Required access

Unknown

Published

Sep 17, 2026 · updated Nov 13, 2026

Credit

Jeremy Felt

WordPress Core is vulnerable to Stored Cross-Site Scripting via the custom header 'header_image_data' theme mod in various versions up to, and including, 7.1 due to insufficient sanitization of the header image width/height/URL values and an unescaped style attribute in the custom-header admin screen. get_custom_header() returned width/height without integer casting and Custom_Image_Header::step_1() echoed the style string without escaping. This makes it possible for authenticated attackers with edit_theme_options capability to inject web scripts; primarily relevant on Multisite where site administrators lack unfiltered_html.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to one of the following versions, or a newer patched version: 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.