WordPress Core is vulnerable to stored cross‑site scripting through the Quick Edit feature because user display names are not properly escaped. Authenticated attackers who have Contributor or higher roles can inject arbitrary JavaScript into the post editing screens. The injected code runs whenever an administrator or other privileged user views those screens, enabling script‑based attacks such as session hijacking, credential theft, or defacement.

The vulnerability affects all WordPress Core installations up to and including version 7.0.2. Sites with a larger user base are more likely to expose many display names that could be exploited.

The CVSS score of 4.9 indicates low severity, and there is no EPSS data available. The vulnerability is not currently listed in the CISA KEV catalog. An attacker must already be authenticated with Contributor level or higher and must manipulate a display name that is displayed in the quick edit form. Because the attack requires in‑site access and does not exploit a remote code execution vector, the likelihood of rapid exploitation is moderate but the impact on privileged users can be significant.