WordPress Core <7.1.1 DOM-Based XSS Vulnerability
CVE-2026-93485 Published on September 18, 2026
WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS.
This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.
The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.
Vulnerability Analysis
CVE-2026-93485 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-93485 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-93485
Want to know whenever a new CVE is published for Automattic Wordpress? stack.watch will email you.
Affected Versions
Automattic WordPress:- Version 7.1 and below 7.1.1 is affected.
- Version 7.0, <= 7.0.4 is affected.
- Version 6.9, <= 6.9.7 is affected.
- Version 6.8, <= 6.8.8 is affected.
- Version 6.7, <= 6.7.7 is affected.
- Version 6.6, <= 6.6.7 is affected.
- Version 6.5, <= 6.5.10 is affected.
- Version 6.4, <= 6.4.10 is affected.
- Version 6.3, <= 6.3.10 is affected.
- Version 6.2, <= 6.2.11 is affected.
- Version 6.1, <= 6.1.12 is affected.
- Version 6.0, <= 6.0.14 is affected.
- Version 5.9, <= 5.9.16 is affected.
- Version 5.8, <= 5.8.15 is affected.
- Version 5.7, <= 5.7.17 is affected.
- Version 5.6, <= 5.6.19 is affected.
- Version 5.5, <= 5.5.20 is affected.
- Version 5.4, <= 5.4.21 is affected.
- Version 5.3, <= 5.3.23 is affected.
- Version 5.2, <= 5.2.26 is affected.
- Version 5.1, <= 5.1.24 is affected.
- Version 5.0, <= 5.0.27 is affected.
- Version 4.9, <= 4.9.31 is affected.
- Version 4.8, <= 4.8.30 is affected.
- Version 4.7, <= 4.7.35 is affected.