WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 patches an unauthenticated stored XSS (CVE-2026-93485) in wpautop(), exploitable via published comments, with CVSS 3.1 score 7.1.
WordPress 7.1.1, released 17 September 2026, contains 11 security fixes and 17 core bug fixes. The headline flaw is CVE-2026-93485, an unauthenticated stored XSS in wpautop() affecting WordPress core up to and including 7.1, rated CVSS 3.1 7.1. A payload submitted through the ordinary comment form survives wp_kses() because a newline placeholder in quoted attribute values becomes a '>' that breaks wpautop()'s regex parsing, enabling script execution in the site origin for any visitor. Comment moderation slows but does not prevent exploitation; the fix makes the regex aware of quoting, and backports shipped to older branches.
- CVE-2026-93485: unauthenticated stored XSS in wpautop() affecting WordPress core up to 7.1, CVSS 3.1 7.1.
- Payload survives wp_kses() because a newline placeholder becomes '>' inside quoted attribute values during display filtering.
- Fix makes the blockquote regex aware of quoted attribute values; backports shipped to older branches.
- Other fixes include contributor-level arbitrary post overwrite and a REST API templates controller path traversal.
- Comment moderation slows but does not prevent exploitation on stock installs.
- CVEs
- CVE-2026-93485
- Vendors
- WordPressPatchstack
- Products
- WordPress
- Organizations
- Patchstack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93485 | Unauthenticated Stored DOM-Based XSS in WordPress Core Affecting 4.7–7.0 | 7.1 | <1% | PoC ×3 |
From the original article
4 min read at patchstack.com
WordPress 7. 1. 1 landed on 17 September 2026.
patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.