CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

┌───────────────┐
│ Unauthenticated│
│    Attacker    │
└───────┬───────┘
        │
        │ Malicious comment input
        ▼
┌────────────────────┐
│ WordPress Comment  │
│    Processing      │
└─────────┬──────────┘
          │
          │ Improper neutralization
          ▼
┌────────────────────┐
│ Stored Application │
│      Content       │
└─────────┬──────────┘
          │
          │ Victim views page
          ▼
┌────────────────────┐
│ Victim Browser     │
│    XSS Execution   │
└────────────────────┘

Attacker-controlled input
          │
          ▼
   Comment processing
          │
          ▼
      wpautop()
          │
          ▼
   HTML generation
          │
          ▼
 Insufficient neutralization
          │
          ▼
      Stored content
          │
          ▼
   Victim renders page

7.1        < 7.1.1
7.0        <= 7.0.4
6.9        <= 6.9.7
6.8        <= 6.8.8
6.7        <= 6.7.7
6.6        <= 6.6.7
6.5        <= 6.5.10
6.4        <= 6.4.10
6.3        <= 6.3.10
6.2        <= 6.2.11
6.1        <= 6.1.12
6.0        <= 6.0.14

5.9        <= 5.9.16
5.8        <= 5.8.15
5.7        <= 5.7.17
5.6        <= 5.6.19
5.5        <= 5.5.20
5.4        <= 5.4.21
5.3        <= 5.3.23
5.2        <= 5.2.26
5.1        <= 5.1.24
5.0        <= 5.0.27
4.9        <= 4.9.31
4.8        <= 4.8.30
4.7        <= 4.7.35

WordPress 7.1.1

wp core version

grep "wp_version" wp-includes/version.php

$ wp core version
7.1.1

#!/usr/bin/env python3

from packaging.version import Version

FIXED_VERSION = Version("7.1.1")


def check_version(version: str):
    current = Version(version)

    if current < FIXED_VERSION:
        print(f"[!] Potentially affected WordPress version: {version}")
        print("[!] Upgrade to a fixed release.")
    else:
        print(f"[+] WordPress version {version} is >= 7.1.1")


if __name__ == "__main__":
    version = input("WordPress version: ").strip()
    check_version(version)

1. Deploy isolated WordPress instance
            │
            ▼
2. Determine exact WordPress version
            │
            ▼
3. Review comment configuration
            │
            ▼
4. Inspect affected processing path
            │
            ▼
5. Compare vulnerable vs patched release
            │
            ▼
6. Verify remediation

┌─────────────────────────────────────┐
│          Isolated Test Lab          │
│                                     │
│  ┌─────────────┐   ┌─────────────┐ │
│  │ Vulnerable  │   │   Patched   │ │
│  │ WordPress   │   │ WordPress   │ │
│  └──────┬──────┘   └──────┬──────┘ │
│         │                   │       │
│         └────────┬──────────┘       │
│                  ▼                  │
│           Behavioral Diff           │
└─────────────────────────────────────┘

[ ] Identify WordPress version
[ ] Check whether the branch is affected
[ ] Upgrade to a fixed release
[ ] Review comment configuration
[ ] Enable comment moderation where appropriate
[ ] Review suspicious recent comments
[ ] Monitor web/application logs
[ ] Inspect unexpected HTML/JavaScript in comments
[ ] Review administrator sessions after suspected compromise
[ ] Re-test after patching

CVE-2026-93485/
│
├── README.md
├── scanner/
│   └── wp_version_check.py
│
├── docs/
│   ├── technical-analysis.md
│   └── mitigation.md
│
├── screenshots/
│   └── lab/
│
├── research/
│   └── notes.md
│
└── LICENSE