AI analysis
CVE-2026-93485 is an unauthenticated stored, DOM-based cross-site scripting vulnerability (CWE-79) in Automattic's WordPress core, caused by improper neutralization of input during web page generation. An attacker with no account can trigger it by submitting a crafted comment on a default installation: comment moderation is disabled by default, and the requirement that a commenter have a previously approved comment can be bypassed, so the payload is stored and later executes in the browsers of anyone viewing the page. Successful exploitation lets the attacker run arbitrary script in a victim's browser, which can be used to hijack sessions or perform actions with the victim's privileges, including those of an administrator who views the compromised content. Any WordPress site running an affected version (4.7 through 7.0.4, or 7.1 before 7.1.1) with comments enabled is affected, which on default settings means essentially all unpatched sites. No public proof-of-concept is known and the issue is not in CISA KEV, so exploitation has not been confirmed.
What to do: Upgrade to WordPress 7.1.1 or later, or apply the patched maintenance release for your current branch when available. Until patched, hold all comments for manual moderation or disable comments entirely, since default settings allow unmoderated comments and the approved-comment requirement can be bypassed. Also review existing comments and content for injected scripts and re-scan after updating.
Affected
| Automattic WordPress (core) | 4.7–4.7.35; 4.8–4.8.30; 4.9–4.9.31; 5.0–5.0.27; 5.1–5.1.24; 5.2–5.2.26; 5.3–5.3.23; 5.4–5.4.21; 5.5–5.5.20; 5.6–5.6.19; 5.7–5.7.17; 5.8–5.8.15; 5.9–5.9.16; 6.0– |
Estimated exposure
masshundreds of millions of WordPress sites potentially affected (essentially every unpatched self-hosted WordPress installation with comments enabled) — WordPress powers roughly 43% of all websites (on the order of hundreds of millions of sites), and the flaw is reproducible on a default installation with comments enabled, so exposure is bounded mainly by unpatched versions rather than…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35. The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.