an anonymous commenter

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenSep 22, 2026
Last mentionedSep 22, 2026

Timeline

1 articles · newest first

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

A crafted comment (Comment2Shell) allowed an attacker to run code on the server via a line break in an HTML attribute. Another flaw, Click2Shell, enabled theme installation and further code execution. WordPress has had…

The Hacker NewsSep 22, 06:03 UTC · Sep 22, 2026Exploit / PoCExploitedCVE-2026-934851 · 1 read

Related CVEs

by mentions

CVE-2026-93485<1%7.1
Unauthenticated Stored DOM-Based XSS in WordPress Core Affecting 4.7–7.0
published Sep 18, 2026Automattic WordPress (core)PoC ×3

Appears with

Click2Shellmalware · 1
WordPress coreproduct · 1
WordPress pluginproduct · 1
WordPress 6.9ai model · 1
U.S. authoritiesvictim · 1
WordPress 4.7ai model · 1
WordPress 7.1ai model · 1
WordPress Coreai model · 1
Patchstackvendor · 1
WordPress 7.0ai model · 1
a blogger named Swati Khandelwalvictim · 1
Microsoftvendor · 1
a blogger named Swati Khandelwalorganization · 1
Comment2Shellmalware · 1

Entities are extracted by the model from each article. First seen Sep 22, 2026, last mentioned Sep 22, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.