{"id":"CVE-2026-93485","aliases":["DEBIAN-CVE-2026-93485","EUVD-2026-82657","GHSA-2pgq-4jch-68j8","UBUNTU-CVE-2026-93485"],"status":"published","title":"WordPress Core \u003c= 7.1 - Cross Site Scripting (XSS) vulnerability","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0076,"percentile":0.55616,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2026-09-18T06:00:05Z","modified":"2026-10-28T20:17:26Z","exploits":[{"source":"pocgithub","id":"HORKimhab/CVE-2026-93485","title":"HORKimhab/CVE-2026-93485","date":"2026-09-22","url":"https://github.com/HORKimhab/CVE-2026-93485"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-93485","title":"ashrafzaryouh/CVE-2026-93485","date":"2026-09-22","url":"https://github.com/ashrafzaryouh/CVE-2026-93485"},{"source":"pocgithub","id":"DeathShotXD/Comment2Shell","title":"DeathShotXD/Comment2Shell","date":"2026-09-25","url":"https://github.com/DeathShotXD/Comment2Shell"},{"source":"pocgithub","id":"686f6c61/POC-WP-CORE-CVE-2026-93485","title":"686f6c61/POC-WP-CORE-CVE-2026-93485","date":"2026-09-26","url":"https://github.com/686f6c61/POC-WP-CORE-CVE-2026-93485"},{"source":"nuclei","id":"CVE-2026-93485","title":"WordPress Core \u003c 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-93485.yaml"}],"fixes":[{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["6.8.10+dfsg1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["7.1.1+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1+dfsg1-1","6.1.6+dfsg1-0+deb12u1","6.1.9+dfsg1-0+deb12u1","6.2+dfsg1-1","6.2.1+dfsg1-1","6.2.2+dfsg1-1","6.3+dfsg1-1","6.3.1+dfsg1-1","6.3.2+dfsg1-1","6.4.1+dfsg1-1","6.4.1+dfsg1-1.1","6.4.2+dfsg1-1","6.4.3+dfsg1-1","6.5+dfsg1-1","6.5.2+dfsg1-1","6.5.3+dfsg1-1","6.5.5+dfsg1-1","6.6.1+dfsg1-1","6.7.2+dfsg1-1","6.7.2+dfsg1-1.1","6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1","7.1.1+dfsg1-1","7.1.2+dfsg1-1","7.1.3+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.10+dfsg1-0+deb13u1"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-0+deb13u1","6.8.3+dfsg1-1","6.8.6+dfsg1-0+deb13u1","6.8.7+dfsg1-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1+dfsg1-1"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2+dfsg1-1","5.2.4+dfsg1-1","5.3.2+dfsg1-1","5.3.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.1+dfsg1-2ubuntu1","5.8.1+dfsg1-2ubuntu1","5.8.2+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg1-1ubuntu1","6.4.3+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1","6.7.2+dfsg1-1.1ubuntu2"]}],"products":[{"vendor":"automattic","product":"wordpress"},{"vendor":"wordpress foundation","product":"wordpress"}],"references":[{"url":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve","tags":["vdb-entry","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93485"},{"url":"https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release"},{"url":"https://github.com/advisories/GHSA-2pgq-4jch-68j8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93485","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-93485","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93485","tags":["report"]},{"url":"https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-93485","title":"WordPress Core \u003c= 7.1 - Cross Site Scripting (XSS) vulnerability","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","status":"published","published":"2026-09-18T06:00:05.645Z","modified":"2026-10-17T08:25:50.124Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-82657","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","status":"published","published":"2026-09-18T06:00:05Z","modified":"2026-10-17T08:25:50Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T17:00:01.37578Z"}],"ghsa":[{"id":"GHSA-2pgq-4jch-68j8","title":"Improper neutralization of input during web page generation ('cross-site scripting')...","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS.\n\n\nThis issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.\n\n\n\n\nThe Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.","status":"published","published":"2026-09-18T06:31:30Z","modified":"2026-09-18T06:32:17Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:12:09.483713Z"}],"nvd":[{"id":"CVE-2026-93485","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","status":"published","published":"2026-09-18T06:16:41.97Z","modified":"2026-10-17T09:16:29.07Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"DEBIAN-CVE-2026-93485","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","status":"published","published":"2026-09-18T06:16:41.97Z","modified":"2026-10-23T17:47:46.753255333Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-93485","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","status":"published","published":"2026-09-18T06:16:00Z","modified":"2026-10-28T20:17:26.936171736Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"}]}}