Cross-Site Scripting in Automattic WordPress Core
CVE-2026-93485

7.1HIGH

Key Information:

Vendor

WordPress
Status
WordPress
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93485?

An improper neutralization of input during web page generation vulnerability in Automattic WordPress core can lead to a DOM-Based XSS attack. This issue arises from the default configuration of WordPress, which allows unauthenticated users to exploit cross-site scripting by bypassing comment moderation settings. The vulnerability can be replicated on a standard WordPress installation, emphasizing the necessity for users to update to the latest versions to safeguard against potential attacks.

Affected Version(s)

WordPress 7.1 < 7.1.1

WordPress 7.0 <= 7.0.4

WordPress 6.9 <= 6.9.7

References

https://patchstack.com/database/wordpress/wordpress/wordp...
vdb-entry
https://wordpress.org/news/2026/09/wordpress-7-1-1-mainte...
release-notes

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad | Patchstack Bug Bounty Program
.