SECURITY researcher Rafie Muhammad published technical details and proof-of-concept code on 21 September 2026 for CVE-2026-93485, a high-severity stored cross-site scripting vulnerability in WordPress core. The flaw has a CVSS score of 7.2 and affects versions before the relevant patched releases, including 7.1, 7.0, 6.9, 6.8, 6.7 and 6.6, as well as 19 earlier versions. The article says there is no confirmed exploitation in the wild, but the public PoC could increase the risk to unpatched sites.
The vulnerability arises from how WordPress sanitises and later renders comments. A specially crafted comment can exploit the interaction between the KSES HTML sanitizer and formatting filters such as `wpautop`, causing attacker-controlled JavaScript to run when an administrator views the affected post.
The article says this can be escalated: the script may use the administrator’s active session to obtain a plugin-installation nonce and upload a ZIP archive containing a PHP web shell, potentially leading to remote code execution and site takeover. The issue is reportedly fixed in WordPress 7.1.1, 7.0.5, 6.9.8 and 6.8.9, with fixes backported to older supported branches down to 4.7.36.
Administrators should update to the appropriate release; the article also recommends requiring manual approval for incoming comments as an additional measure.