Weekly security digest: 2 November 2026

WordPress vulnerabilities

Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

• Gravity Forms: affects up to 3.1.2, fixed in 3.1.3
• Severity: CVSS 9.8
• CVE: CVE-2026-103039
• Read the advisory

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

• WordPress core: affects 4.7.0 to 4.7.38, 4.8.0 to 4.8.33, 4.9.0 to 4.9.34, 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, 5.4.0 to 5.4.24, 5.5.0 to 5.5.23, 5.6.0 to 5.6.22, 5.7.0 to 5.7.20, 5.8.0 to 5.8.18, 5.9.0 to 5.9.19, 6.0.0 to 6.0.17, 6.1.0 to 6.1.15, 6.2.0 to 6.2.14, 6.3.0 to 6.3.13, 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 4.7.39
• Severity: CVSS 8.1
• CVE: CVE-2026-119977
• Read the advisory

WordPress Core 5.0.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Customizer Selective Refresh

• WordPress core: affects 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, 5.4.0 to 5.4.24, 5.5.0 to 5.5.23, 5.6.0 to 5.6.22, 5.7.0 to 5.7.20, 5.8.0 to 5.8.18, 5.9.0 to 5.9.19, 6.0.0 to 6.0.17, 6.1.0 to 6.1.15, 6.2.0 to 6.2.14, 6.3.0 to 6.3.13, 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 5.0.31
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 6.4.0 - 7.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via Interactivity Router Uploaded Text Files

• WordPress core: affects 6.4.0 to 6.4.14, 6.5.0 to 6.5.14, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.6.11
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 5.0.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Non-HTML Whitespace in Block Delimiters

• WordPress core: affects 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, 5.4.0 to 5.4.24, 5.5.0 to 5.5.23, 5.6.0 to 5.6.22, 5.7.0 to 5.7.20, 5.8.0 to 5.8.18, 5.9.0 to 5.9.19, 6.0.0 to 6.0.17, 6.1.0 to 6.1.15, 6.2.0 to 6.2.14, 6.3.0 to 6.3.13, 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 5.0.31
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Prototype Pollution

• WordPress core: affects 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.4.14
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Event Handler Bindings

• WordPress core: affects 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.6.11
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API URL Bindings

• WordPress core: affects 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.4.14
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 5.9.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Block Labels

• WordPress core: affects 5.9.0 to 5.9.19, 6.0.0 to 6.0.17, 6.1.0 to 6.1.15, 6.2.0 to 6.2.14, 6.3.0 to 6.3.13, 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 5.9.20
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity Script Module Data Shadowing

• WordPress core: affects 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.6.11
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image and Playlist Blocks

• WordPress core: affects 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.4.14
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 6.7.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Categories Block

• WordPress core: affects 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.7.11
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Unsafe Interactivity API Binding Properties

• WordPress core: affects 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.6.11
• Severity: CVSS 6.4
• Read the advisory

WordPress Core 4.9.0 - 7.1.3 - Unauthenticated Sensitive Information Exposure via Customizer Changesets

• WordPress core: affects 4.9.0 to 4.9.34, 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, 5.4.0 to 5.4.24, 5.5.0 to 5.5.23, 5.6.0 to 5.6.22, 5.7.0 to 5.7.20, 5.8.0 to 5.8.18, 5.9.0 to 5.9.19, 6.0.0 to 6.0.17, 6.1.0 to 6.1.15, 6.2.0 to 6.2.14, 6.3.0 to 6.3.13, 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 4.9.35
• Severity: CVSS 5.3
• Read the advisory

WordPress Core 4.7.0 - 7.1.3 - Authenticated (Custom+) Stored Cross-Site Scripting via Externally-Supplied User Login Values

• WordPress core: affects 4.7.0 to 4.7.38, 4.8.0 to 4.8.33, 4.9.0 to 4.9.34, 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, 5.4.0 to 5.4.24, 5.5.0 to 5.5.23, 5.6.0 to 5.6.22, 5.7.0 to 5.7.20, 5.8.0 to 5.8.18, 5.9.0 to 5.9.19, 6.0.0 to 6.0.17, 6.1.0 to 6.1.15, 6.2.0 to 6.2.14, 6.3.0 to 6.3.13, 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 4.7.39
• Severity: CVSS 4.9
• Read the advisory

WordPress Core 4.9.6 - 7.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Personal Data Erasure Request Email Addresses

• WordPress core: affects 4.9.6 to 4.9.34, 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, 5.4.0 to 5.4.24, 5.5.0 to 5.5.23, 5.6.0 to 5.6.22, 5.7.0 to 5.7.20, 5.8.0 to 5.8.18, 5.9.0 to 5.9.19, 6.0.0 to 6.0.17, 6.1.0 to 6.1.15, 6.2.0 to 6.2.14, 6.3.0 to 6.3.13, 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 4.9.35
• Severity: CVSS 4.4
• Read the advisory

WordPress Core 6.9.0 - 7.1.3 - Authenticated (Custom+) Incorrect Authorization to Read, Modify, and Delete Notes via REST API

• WordPress core: affects 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.9.11
• Severity: CVSS 3.8
• Read the advisory

WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Denial of Service via Malformed Interactivity API Bindings

• WordPress core: affects 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.4.14
• Severity: CVSS 3.5
• Read the advisory

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Clickjacking via Interactivity API Object Bindings

• WordPress core: affects 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3, fixed in 6.6.11
• Severity: CVSS 3.5
• Read the advisory

SilverStripe advisories

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

• Package: silverstripe/mfa
• Affected: <6.0.0
• CVE: CVE-2026-55186
• Read the advisory

Releases

• WordPress: WordPress 7.1.4 (28 October 2026)

Vulnerability data from Wordfence Intelligence. Each entry links to its record. Copyright 2012-2026 Defiant Inc. Copyright 1999-2026 The MITRE Corporation. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.