CVE-2026-93485
CVSS 7.1 HIGH: improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic… EPSS 0.2% (6th percentile).
Vulnerabilities & Exploits · Web App Attack
WordPress fixed a core comment flaw, CVE-2026-93485, in version 7.1.1 on September 17 after Rafie Muhammad found that an anonymous comment could plant a hidden script that becomes dangerous when a logged-in administrator views the page. Patchstack assigned the identifier and rated it 7.1/10.
The bug sits between save-time filtering and render-time rewriting. WordPress checked the comment when it was stored, then reshaped the same HTML when it was displayed; a line break inside an allowed tag survived the first pass but turned into a live browser handler on the second, so the page ran attacker code automatically. If an admin’s session is present, that browser-side code can use it to push a plugin and reach server code execution.
For sites that allow public comments, the exposure lives in content that looks harmless at entry time but changes shape when rendered. Moderation is not a clean boundary here: the risky step is the display path, and any CMS that rewrites stored user content on output inherits the same trust problem.
1 source · 3h ago
CVSS 7.1 HIGH: improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic… EPSS 0.2% (6th percentile).
The Hacker News
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
WordPress fixed a comment flaw that could lead to server code execution if a logged-in administrator opened the page.
originalPart of the PlainSec briefing for 2026-09-22
Every edition of this story: WordPress Comment Bug Could Escalate to Server Control