CVE-2026-114570 is a stored cross-site scripting vulnerability in WordPress Core, caused by insufficient escaping of user display names in Quick Edit.
It affects all versions up to 7.0.2 and requires contributor-level access. No in-the-wild exploitation is confirmed.
WordPress 7.0.3 fixes the issue.