WordPress Comment2Shell Vulnerability Lets Hackers Take Over Sites Through Comments
WordPress patched CVE-2026-93485, a stored XSS called Comment2Shell that can lead to admin-triggered command execution.
WordPress fixed CVE-2026-93485, an unauthenticated stored cross-site scripting flaw in wpautop(), in version 7.1.1 and in patched builds back to 4.7.36. A crafted blockquote cite attribute bypasses initial sanitization and, on display, injects onfocus and autofocus handlers that run JavaScript when the comment is viewed. The public Comment2Shell proof of concept can then use an administrator session to install a plugin webshell, execute a command, and remove traces. The issue scores CVSS 7.1, affects releases 4.7 through 7.1.0, and had no reported active exploitation at disclosure.
- CVE-2026-93485 is stored XSS in wpautop(), scored CVSS 7.1 and fixed in 7.1.1.
- Comment2Shell uses an admin viewing a comment to upload a plugin webshell.
- Exploitation requires enabled comments and a privileged user opening the post.
- Vulnerable versions span WordPress 4.7 through 7.1.0, with older branch patches.
- Active exploitation was not reported, but a public proof of concept is available.
- CVEs
- CVE-2026-93485
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- Awesome MotiveWordPress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93485 | Unauthenticated Stored DOM-Based XSS in WordPress Core Affecting 4.7–7.0 | 7.1 | <1% | PoC ×3 |
From the original article
2 min read at cybersecuritynews.com
WordPress administrators are being urged to patch a high-severity core vulnerability that can turn an anonymous comment into server-side command execution. Tracked as CVE-2026-93485 and demonstrated by the Comment2Shell proof-of-concept, the flaw is an unauthenticated stored cross-site scripting issue in WordPress’s wpautop() formatting function. WordPress fixed the vulnerability in version 7.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.