WordPress XSS Flaw Could Let Attackers Take Over Sites via Comments

Security researcher Rafie Muhammad published technical details and working proof-of-concept code on 21 September 2026 for CVE-2026-93485, a high-severity stored cross-site scripting vulnerability in WordPress core. Rated 7.2 (CVSSv3), the flaw affects versions before 7.1.1, with fixes also backported to older supported branches, including 4.7.36. The report says there is no confirmed exploitation in the wild, but public exploit code increases the potential risk to sites that accept comments.

The vulnerability arises from the way WordPress sanitises comments when they are saved and subsequently formats them for display. A crafted comment using a newline in a permitted `blockquote` `cite` attribute can confuse the `wpautop` and related formatting filters, causing browser-interpreted HTML attributes and event handlers to be injected. When an administrator views the comment, the script can run in their authenticated session.

According to the report, the proof of concept retrieves a plugin-installer nonce and uploads a ZIP containing a PHP web shell, potentially escalating the attack from XSS to remote code execution and site takeover.

Administrators should update to WordPress 7.1.1 or the applicable patched branch immediately. The article also recommends requiring manual approval for all comments as an additional measure, although updating addresses the underlying defect.