Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Automattic | WordPress | 7.1, 7.0 – ≤ 7.0.4, 6.9 – ≤ 6.9.7, 6.8 – ≤ 6.8.8, 6.7 – ≤ 6.7.7, 6.6 – ≤ 6.6.7, 6.5 – ≤ 6.5.10, 6.4 – ≤ 6.4.10, 6.3 – ≤ 6.3.10, 6.2 – ≤ 6.2.11, 6.1 – ≤ 6.1.12, 6.0 – ≤ 6.0.14, 5.9 – ≤ 5.9.16, 5.8 – ≤ 5.8.15, 5.7 – ≤ 5.7.17, 5.6 – ≤ 5.6.19, 5.5 – ≤ 5.5.20, 5.4 – ≤ 5.4.21, 5.3 – ≤ 5.3.23, 5.2 – ≤ 5.2… | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 7.1.1+dfsg1-1 | — |
| Debian 13 | wordpress | 6.8.10+dfsg1-0+deb13u1 | — |
| Debian 12 | wordpress | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | wordpress | No fix yet | — |
| Ubuntu 26.04 LTS | wordpress | No fix yet | — |
| Ubuntu 24.04 LTS | wordpress | No fix yet | — |
| Ubuntu 22.04 LTS | wordpress | No fix yet | — |
| Ubuntu 20.04 LTS | wordpress | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | wordpress | No fix yet | — |
| Ubuntu 16.04 LTS | wordpress | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 4 repositories
-
DeathShotXD/Comment2Shell ★ 68 · Sep 25, 2026
Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Ful…
-
686f6c61/POC-WP-CORE-CVE-2026-93485 ★ 2 · Sep 26, 2026
Laboratorio pedagógico de CVE-2026-93485 (Comment2Shell): stored XSS no autenticado en WordPress core vía wpautop -> RCE, con demo del root cause auto-verificada, control 7.1.1 y la vía Post2Shell
-
HORKimhab/CVE-2026-93485 ★ 0 · Sep 22, 2026
CVE-2026-93485 - Draft or TODO
-
ashrafzaryouh/CVE-2026-93485 ★ 0 · Sep 22, 2026
CVE-2026-93485
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell) http/cves/2026/CVE-2026-93485.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2026-3472 WordPress: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 28, 2026