---

🧬 Overview

CVE-2026-93485 is a high-severity cross-site scripting vulnerability affecting the WordPress core.

The vulnerability is described as improper neutralization of user-controlled input during web-page generation, resulting in DOM-based XSS / stored XSS behavior.

The published advisory states that an unauthenticated attacker can submit malicious comment content, which may subsequently execute in the browser of a user viewing affected content.

The issue is associated with WordPress comment handling and can affect installations using default comment configuration.

---

🔥 Vulnerability Snapshot

Property	Details
CVE	CVE-2026-93485
Product	WordPress Core
Vendor	Automattic
Type	Cross-Site Scripting
CWE	CWE-79
Attack Type	Stored / DOM-Based XSS
Authentication	Not required
User Interaction	Required
Attack Vector	Network
Complexity	Low
CVSS v3.1	7.1 — High
Published	18 September 2026

CVSS vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

The CVSS 7.1 rating and vector are reported by the GitHub Advisory Database and Ubuntu security tracker.

---

🎯 Attack Surface

The reported vulnerability involves the WordPress comment-processing/rendering path.

A simplified attack flow is:

┌───────────────┐
│ Unauthenticated│
│    Attacker    │
└───────┬───────┘
        │
        │ Malicious comment input
        ▼
┌────────────────────┐
│ WordPress Comment  │
│    Processing      │
└─────────┬──────────┘
          │
          │ Improper neutralization
          ▼
┌────────────────────┐
│ Stored Application │
│      Content       │
└─────────┬──────────┘
          │
          │ Victim views page
          ▼
┌────────────────────┐
│ Victim Browser     │
│    XSS Execution   │
└────────────────────┘

According to the published vulnerability description, the normal requirement for a commenter to have a previously approved comment can be bypassed under the affected conditions.

---

🧠 Technical Description

The underlying weakness is classified as:

CWE-79 — Improper Neutralization of Input During Web Page Generation

The vulnerability occurs when attacker-controlled input reaches a web-page generation path without adequate neutralization.

The reported issue is particularly relevant to the processing of WordPress comments and the handling of line breaks / generated HTML. CERT Santé's technical summary identifies the wpautop() processing path as relevant to the vulnerability.

Conceptually:

Attacker-controlled input
          │
          ▼
   Comment processing
          │
          ▼
      wpautop()
          │
          ▼
   HTML generation
          │
          ▼
 Insufficient neutralization
          │
          ▼
      Stored content
          │
          ▼
   Victim renders page

---

Demo

📦 Affected Versions

The advisory lists multiple vulnerable WordPress branches.

Current 7.x branches

7.1        < 7.1.1
7.0        <= 7.0.4
6.9        <= 6.9.7
6.8        <= 6.8.8
6.7        <= 6.7.7
6.6        <= 6.6.7
6.5        <= 6.5.10
6.4        <= 6.4.10
6.3        <= 6.3.10
6.2        <= 6.2.11
6.1        <= 6.1.12
6.0        <= 6.0.14

Legacy branches

5.9        <= 5.9.16
5.8        <= 5.8.15
5.7        <= 5.7.17
5.6        <= 5.6.19
5.5        <= 5.5.20
5.4        <= 5.4.21
5.3        <= 5.3.23
5.2        <= 5.2.26
5.1        <= 5.1.24
5.0        <= 5.0.27
4.9        <= 4.9.31
4.8        <= 4.8.30
4.7        <= 4.7.35

These affected ranges are documented by the GitHub Advisory Database and Debian security tracker.

---

🛡️ Mitigation

Recommended

Upgrade WordPress to a fixed release for your branch.

For the 7.1 branch, the documented fixed release is:

WordPress 7.1.1

The WordPress security/maintenance release was published on 17 September 2026.

Check the installed version:

wp core version

Or from the WordPress installation directory:

grep "wp_version" wp-includes/version.php

Example:

$ wp core version
7.1.1

---

🔎 Safe Detection

A defensive version check can identify potentially affected installations without submitting an XSS payload.

#!/usr/bin/env python3

from packaging.version import Version

FIXED_VERSION = Version("7.1.1")


def check_version(version: str):
    current = Version(version)

    if current < FIXED_VERSION:
        print(f"[!] Potentially affected WordPress version: {version}")
        print("[!] Upgrade to a fixed release.")
    else:
        print(f"[+] WordPress version {version} is >= 7.1.1")


if __name__ == "__main__":
    version = input("WordPress version: ").strip()
    check_version(version)

Note: This simplified checker is intended for the 7.1 branch. WordPress backport releases use branch-specific fixed versions, so production scanners should maintain a complete version matrix rather than treating 7.1.1 as a universal minimum.

---

🧪 Safe Research Methodology

A controlled lab assessment should use:

1. Deploy isolated WordPress instance
            │
            ▼
2. Determine exact WordPress version
            │
            ▼
3. Review comment configuration
            │
            ▼
4. Inspect affected processing path
            │
            ▼
5. Compare vulnerable vs patched release
            │
            ▼
6. Verify remediation

Recommended laboratory setup:

┌─────────────────────────────────────┐
│          Isolated Test Lab          │
│                                     │
│  ┌─────────────┐   ┌─────────────┐ │
│  │ Vulnerable  │   │   Patched   │ │
│  │ WordPress   │   │ WordPress   │ │
│  └──────┬──────┘   └──────┬──────┘ │
│         │                   │       │
│         └────────┬──────────┘       │
│                  ▼                  │
│           Behavioral Diff           │
└─────────────────────────────────────┘

This repository intentionally avoids weaponized payloads and focuses on defensive verification and patch validation.

---

🔬 Security Impact