How it was found

Stored XSS in the Classic block element path

Affected: WordPress development build 7.2-alpha-64254, commit 7fdd5ebe4bbcf9e92d7f85ae662efabc936f4235. No released version contained this change as of 2026-10-09; stock 7.1.3 retains elementpath = false.

Summary: A default Author can save an image with an entity-encoded HTML payload in data-wp-more. WordPress KSES preserves the data-* attribute. When an Administrator edits the post in the Classic block and selects the image, the WordPress TinyMCE plugin copies its decoded attribute value into ResolveName. TinyMCE's modern theme inserts that name into the element-path UI as HTML. The development commit removed the editor setting that previously disabled this path, enabling stored script execution in the Administrator's browser. The relevant code is class-wp-editor.php, the WordPress TinyMCE ResolveName handler, and the modern theme element-path renderer.

Minimal reproduction

1. From this directory, run cp .env.example .env and docker compose up -d --build, open http://127.0.0.1:18081, complete WordPress installation, and create a user with the Author role. The Dockerfile pins the affected development commit and includes its compiled editor assets.

2. Sign in as the Author. In Posts → Add New, open the top-right ⋮ → Code editor and enter a title and this content:

   <p><img src="/wp-includes/images/w-logo-blue-white-bg.png" width="100" data-wp-more="&lt;img src=x onerror=alert(document.domain)&gt;"></p>
   

{F6948286}

3. Switch to Visual editor and save the draft. The content becomes a Classic (core/freeform) block, with the encoded attribute intact.
4. Sign in as an Administrator and edit that draft. Select the Classic block, click Edit, then click the image inside the Classic Editor modal.

{F6948287}

Observed result: The image's data-wp-more value is decoded and inserted into the element-path HTML. The nested image fails to load and alert(document.domain) runs in the Administrator's editor page. This requires the Administrator to open the Classic editor and select the image; merely viewing the post does not trigger it.

Impact

A WordPress author is able to create a malicious post. If an admin select the image in the post in the classic block editor, then an attacker-chosen XSS payload executes.