CVE-2026-93485

CVE-2026-93485 is an unauthenticated stored, DOM-based cross-site scripting vulnerability (CWE-79) in Automattic's WordPress core, caused by improper neutralization of input during web page generation. An attacker with no account can trigger it by submitting a crafted comment on a default installation: comment moderation is disabled by default, and the requirement that a commenter have a previously approved comment can be bypassed, so the payload is stored and later executes in the browsers of anyone viewing the page. Successful exploitation lets the attacker run arbitrary script in a victim's browser, which can be used to hijack sessions or perform actions with the victim's privileges, including those of an administrator who views the compromised content. Any WordPress site running an affected version (4.7 through 7.0.4, or 7.1 before 7.1.1) with comments enabled is affected, which on default settings means essentially all unpatched sites. No public proof-of-concept is known and the issue is not in CISA KEV, so exploitation has not been confirmed.

What to do: Upgrade to WordPress 7.1.1 or later, or apply the patched maintenance release for your current branch when available. Until patched, hold all comments for manual moderation or disable comments entirely, since default settings allow unmoderated comments and the approved-comment requirement can be bypassed. Also review existing comments and content for injected scripts and re-scan after updating.