Story · 4 sources · 4 articlesfirst Sep 17, 19:53 UTCupdated Sep 18, 07:53 UTC (7h ago)

WordPress 7.1.1 Fixes 11 Security Issues, Including CVE-2026-93485 Stored XSS in wpautop()

highVulnerabilityimportance 65CVE-2026-93485

What's new: Added CVE id and severity from Patchstack: the wpautop() stored XSS is now tracked as CVE-2026-93485, CVSS 3.1 7.1, affecting core up to and including 7.1 — the previous summary stated no CVE ids were disclosed (the WordPress.org announcement itself did not list one, so the sources disagree). Added the technical root cause and fix description: payload survives wp_kses() via a newline placeholder…

Merged summary · glm-5.3-flash · rewritten as coverage arrives

WordPress 7.1.1 (released 2026-09-17) patches 11 security issues — headline: unauthenticated stored XSS in wpautop() tracked as CVE-2026-93485 (CVSS 3.1 7.1) affecting core up to and including 7.1 — plus an authenticated REST Templates Controller path…

WordPress 7.1.1 is a short-cycle maintenance and security release announced on 2026-09-17 that addresses 11 security issues alongside 17 core bug fixes and 19 Block Editor bug fixes. The headline flaw is an unauthenticated stored XSS in wpautop(), which Patchstack tracks as CVE-2026-93485 with a CVSS 3.1 score of 7.1, affecting WordPress core up to and including 7.1 (the WordPress.org announcement itself disclosed no CVE ids). Per Patchstack, a payload submitted through the ordinary comment form survives wp_kses() because a newline placeholder inside quoted attribute values becomes a '>' during display filtering, breaking wpautop()'s regex parsing and enabling script execution in the site origin for any visitor; the fix makes the blockquote regex aware of quoted attribute values. GBHackers reports the injected script executes when a moderator approves the comment, potentially enabling admin session theft, while Patchstack notes that comment moderation slows but does not prevent exploitation on stock installs. Other fixes include stored XSS in themes with custom headers, an authenticated path traversal in the WP REST Templates Controller reported by Anthropic (which, per GBHackers, also reported an authorization flaw letting low-privileged users overwrite posts outside their scope — WordPress.org describes this as Contributor+ arbitrary post overwrite and slug disclosure), missing authorization checks, specially crafted URLs that auto-install and preview inactive themes from WordPress.org, an XML-RPC issue allowing publishing of customize_changeset posts while bypassing edit_css checks, private post title disclosure, and comment reparenting by any authenticated user. No in-the-wild exploitation is reported. Security fixes are backported to all branches eligible for security fixes, currently through WordPress 4.7. Administrators are urged to update immediately or rely on automatic background updates, and WordPress 7.2 is expected in December.

WordPress 7.1.1 released 2026-09-17: 11 security fixes plus 17 core and 19 Block Editor bug fixes.
CVE-2026-93485 (per Patchstack): unauthenticated stored XSS in wpautop() affecting WordPress core up to and including 7.1, CVSS 3.1 score 7.1; the WordPress.org announcement did not list any CVE ids.
Bypass mechanism: comment-form payload survives wp_kses() because a newline placeholder in quoted attribute values becomes a '>' during display filtering, breaking wpautop()'s regex parsing; the fix makes the blockquote regex aware of…
Execution: script runs in the site origin for any visitor once the comment is displayed; per GBHackers it executes when a moderator approves the comment (potentially enabling admin session theft), while Patchstack notes moderation slows…
Authenticated path traversal in the WP REST Templates Controller, reported by Anthropic.
Authorization flaw: Contributor+ arbitrary post overwrite and slug disclosure (WordPress.org); per GBHackers, reported by Anthropic as low-privileged users overwriting posts outside their scope.
Stored XSS in themes with custom headers.
Specially crafted URLs can auto-install and preview inactive themes from WordPress.org.

VendorsWordPress Patchstack Automattic Awesome Motive Anthropic

ProductsWordPress WordPress 7.1.1 WP REST Templates Controller

OrganizationsPatchstack Anthropic WordPress WordPress.org

AI modelsAnthropic

Coverage timelineoldest first · each row is one article

Sep 17, 19:53 UTC · 19h ago
WordPress.org · Security· 45
WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 ships 11 security fixes including unauthenticated stored XSS in wpautop(), path traversal, and theme installation flaws; update immediately.
06:56 UTC · 8h ago
Patchstack· 65
WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 patches an unauthenticated stored XSS (CVE-2026-93485) in wpautop(), exploitable via published comments, with CVSS 3.1 score 7.1.
07:44 UTC · 7h ago
Cyber Security News· 60
WordPress Urges Immediate Update After Fixing 11 Security Vulnerabilities
WordPress 7.1.1 fixes 11 core vulnerabilities including stored XSS, path traversal, and authorization bypass flaws; admins urged to update immediately.
07:53 UTC · 7h ago
GBHackers· 50
WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal
WordPress 7.1.1 patches 11 core vulnerabilities, including stored XSS in wpautop() and an authenticated path traversal in the REST Templates Controller reported by Anthropic.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-93485	Unauthenticated Stored DOM-Based XSS in WordPress Core Affecting 4.7–7.0 CVE-2026-93485 is an unauthenticated stored, DOM-based cross-site scripting vulnerability (CWE-79) in Automattic's WordPress core, caused by improper neutralization of input during web page generation. An attacker with no account can trigger it by submitting a crafted comment on a default installation: comment moderation is disabled by default, and the requirement that a commenter have a previously approved comment can be bypassed, so the payload is stored and later executes in the browsers of anyone viewing the page. Successful exploitation lets the attacker run arbitrary script in a victim's browser, which can be used to hijack sessions or perform actions with the victim's privileges, including those of an administrator who views the compromised content. Any WordPress site running an affected version (4.7 through 7.0.4, or 7.1 before 7.1.1) with comments enabled is affected, which on default settings means essentially all unpatched sites. No public proof-of-concept is known and the issue is not in CISA KEV, so exploitation has not been confirmed. Do: Upgrade to WordPress 7.1.1 or later, or apply the patched maintenance release for your current branch when available. Until patched, hold all comments for manual moderation or disable comments entirely, since default settings allow unmoderated comments and the approved-comment requirement can be bypassed. Also review existing comments and content for injected scripts and re-scan after updating.	7.1	—		Automattic WordPress (core) 4.7–4.7.35; 4.8–4.8.30; 4.9–4.9.31; 5.0–5.0.27; 5.1–5.1.24; 5.2–5.2.26; 5.3–5.3.23; 5.4–5.4.21; 5.5–5.5.20; 5.6–5.6.19; 5.7–5.7.17; 5.8–5.8.15; 5.9–5.9.16; 6.0–	masshundreds of millions of WordPress sites potentially affected (essentially every unpatched self-hosted WordPress installation with comments enabled)	8h ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-93485

Unauthenticated Stored DOM-Based XSS in WordPress Core Affecting 4.7–7.0

CVE-2026-93485 is an unauthenticated stored, DOM-based cross-site scripting vulnerability (CWE-79) in Automattic's WordPress core, caused by improper neutralization of input during web page generation. An attacker with no account can trigger it by submitting a crafted comment on a default installation: comment moderation is disabled by default, and the requirement that a commenter have a previously approved comment can be bypassed, so the payload is stored and later executes in the browsers of anyone viewing the page. Successful exploitation lets the attacker run arbitrary script in a victim's browser, which can be used to hijack sessions or perform actions with the victim's privileges, including those of an administrator who views the compromised content. Any WordPress site running an affected version (4.7 through 7.0.4, or 7.1 before 7.1.1) with comments enabled is affected, which on default settings means essentially all unpatched sites. No public proof-of-concept is known and the issue is not in CISA KEV, so exploitation has not been confirmed.

Do: Upgrade to WordPress 7.1.1 or later, or apply the patched maintenance release for your current branch when available. Until patched, hold all comments for manual moderation or disable comments entirely, since default settings allow unmoderated comments and the approved-comment requirement can be bypassed. Also review existing comments and content for injected scripts and re-scan after updating.

7.1

—

Automattic WordPress (core) 4.7–4.7.35; 4.8–4.8.30; 4.9–4.9.31; 5.0–5.0.27; 5.1–5.1.24; 5.2–5.2.26; 5.3–5.3.23; 5.4–5.4.21; 5.5–5.5.20; 5.6–5.6.19; 5.7–5.7.17; 5.8–5.8.15; 5.9–5.9.16; 6.0–

masshundreds of millions of WordPress sites potentially affected (essentially every unpatched self-hosted WordPress installation with comments enabled)

8h ago