WordPress: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 1

• High 7.1
  CVE-2026-93485 Public exploit Scanner template

  WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.

  Automattic WordPress wordpress wordpress Web / CMS Debian Ubuntu
  Sep 18, 2026

Revision history

1. 2026-09-28 #4

   Neue Updates von Debian aufgenommen

2. 2026-09-23 #3

   Weitere gefixte WordPress Versionen ergänzt

3. 2026-09-21 #2

   CVE + Bezeichner "Comment2Shell" ergänzt

4. 2026-09-20 #1

   Initiale Fassung

References

• WordPress 7.1.1 Maintenance and Security Release vom 2026-09-20
  https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/
• GitHub Security Advisory GHSA-32m5-wc28-ghrr vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-32m5-wc28-ghrr
• GitHub Security Advisory GHSA-33wf-p63q-w25f vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-33wf-p63q-w25f
• GitHub Security Advisory GHSA-5qf7-2r5p-ppj8 vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-5qf7-2r5p-ppj8
• Pwn.ai Research - Click2Shell vom 2026-09-20
  https://pwn.ai/blog/click2shell
• GitHub Security Advisory GHSA-76jg-r2qr-v77f vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-76jg-r2qr-v77f
• GitHub Security Advisory GHSA-cjfg-q57r-mq45 vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-cjfg-q57r-mq45
• GitHub Security Advisory GHSA-f522-h982-63mg vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-f522-h982-63mg
• GitHub Security Advisory GHSA-mgvw-845h-9qgq vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-mgvw-845h-9qgq
• GitHub Security Advisory GHSA-qg7r-fjh2-wvx8 vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qg7r-fjh2-wvx8
• GitHub Security Advisory GHSA-rmpv-w5v9-rqh5 vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rmpv-w5v9-rqh5
• GitHub Security Advisory GHSA-w57f-v787-qhpf vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-w57f-v787-qhpf
• GitHub Security Advisory GHSA-xhp5-863h-rhfr vom 2026-09-20
  https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhp5-863h-rhfr
• Comment2Shell: Zero-Click Pre-Auth XSS to RCE in WordPress Core vom 2026-09-21
  https://idnsec.com/research/comment2shell-zero-click-pre-auth-xss-to-rce-in-wordpress-core/
• Debian Security Advisory DSA-6525 vom 2026-09-28
  https://security-tracker.debian.org/tracker/DSA-6525-1