WordPress wordpress core

WordPress <= 6.9.1 — Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items

572fe891-5845-4a1c-ad3e-ddf5c54af5baPublished Mar 10, 2026 · Updated Nov 13, 2026

Affected: ≤6.9.1Update to 6.8.4 or 6.9.2 or newer

Fixed versions are per release branch: update to the fix for the branch you run.

All remediation steps

Watch core

Medium4.4CVSS 3.14.4CISA KEVNot listedAccessAdmin account required

On this page3

Overview

Advisory ID: 572fe891-5845-4a1c-ad3e-ddf5c54af5ba
Product: WordPress wordpress
Affected: ≤6.9.1
Fixed in: 6.8.4, 6.9.2
Weakness: CWE-79 Cross-Site Scripting
Required access: Admin account required
Published: Mar 10, 2026 · updated Nov 13, 2026
Credit: sibwtf

Affected≤ 6.9.1
Patched in6.8.4 / 6.9.2

4.4

CVSS 3.1 · CNA (Wordfence)

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

What does this vector mean?

AV:N Attack vector: Network
AC:H Attack complexity: High
PR:H Privileges required: High
UI:N User interaction: None
S:C Scope: Changed
C:L Confidentiality: Low
I:L Integrity: Low
A:N Availability: None

WordPress Core is vulnerable to Stored Cross-Site Scripting via admin settings in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

This only affects multi-site installations and installations where unfiltered_html has been disabled.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

Update to one of the following versions, or a newer patched version: 6.8.4, 6.9.2
Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.

References & provenance

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

Advisorywordfence.com

Timeline

Mar 10, 2026
CVE published
Severity medium, CVSS 4.4
Nov 13, 2026
Record last updated

Sources & licenses

Vulnerability data: Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVSS / CWE: National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.

How we use these sources