/Vulnerability Library

WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)

CVE-2026-93485
Early Release

Description

WordPress core before 7.1.1 is vulnerable to unauthenticated stored XSS via crafted blockquote comments. wp_kses_post accepts a <blockquote> with a literal newline in the cite attribute, wpautop's non-quote-aware regex injects a <p> inside the cite value, and wptexturize leaves the attribute open so onfocus/autofocus land on <code> as real HTML attributes, giving zero-click stored XSS. Only triggers when comments are open and auto-approved.

Severity

High

CVSS Score

7.1

Affected Product

wordpress

Published Date

October 26, 2026

Template Author

dhiyaneshdk

CVE-2026-93485.yaml
7.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVE ID:
cve-2026-93485
CWE ID:
cwe-79

References

https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/https://github.com/686f6c61/POC-WP-CORE-CVE-2026-93485https://github.com/DeathShotXD/Comment2Shellhttps://www.cve.org/CVERecord?id=CVE-2026-93485

Remediation Steps

Update WordPress to 7.1.1 or a backport release (7.0.5+, 6.9.8+, 6.8.9+, down to 4.7.36+), which makes wpautop's blockquote regex quote-aware.