WordPress wordpress core

WordPress Core <= 7.1 — HTML API set_modifiable_text() Comment Boundary Break

c41aadb1-e1a6-4bda-ac94-c461c320e78fPublished Sep 17, 2026 · Updated Nov 13, 2026

Affected: ≤7.1Update to 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1 or newer

Fixed versions are per release branch: update to the fix for the branch you run.

All remediation steps

Watch core

Low3.7CVSS 3.13.7CISA KEVNot listedAccessNo account needed

On this page3

Overview

Advisory ID: c41aadb1-e1a6-4bda-ac94-c461c320e78f
Product: WordPress wordpress
Affected: ≤7.1
Fixed in: 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
Weakness: CWE-116 Improper Encoding or Escaping of Output
Required access: No account needed
Published: Sep 17, 2026 · updated Nov 13, 2026
Credit: Jeremy Felt

Affected≤ 7.1
Patched in6.7.8 / 6.8.9 / 6.9.8 / 7.0.5 / 7.1.1

3.7

CVSS 3.1 · CNA (Wordfence)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

What does this vector mean?

AV:N Attack vector: Network
AC:H Attack complexity: High
PR:N Privileges required: None
UI:N User interaction: None
S:U Scope: Unchanged
C:N Confidentiality: None
I:L Integrity: Low
A:N Availability: None

WordPress Core's HTML API WP_HTML_Tag_Processor::set_modifiable_text() (since 6.7.0) used an incomplete comment-closer guard (/--!?>/) that missed the '-?>' abrupt-closing form, allowing text set into an HTML comment node to terminate the comment early. This is developer-facing hardening; there is no first-party sink that turns it into a direct vulnerability. Impact is realized only in plugin/theme code that round-trips attacker-controlled text through the HTML API into a comment node.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

Update to one of the following versions, or a newer patched version: 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.

References & provenance

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

Advisorywordfence.com

Timeline

Sep 17, 2026
CVE published
Severity low, CVSS 3.7
Nov 13, 2026
Record last updated

Sources & licenses

Vulnerability data: Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVSS / CWE: National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.

How we use these sources