CVE-2026-93485

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7 through 7.1

Description An unauthenticated stored cross-site scripting (XSS) issue, dubbed Comment2Shell, exists in the WordPress core. The flaw occurs in the wpautop() function, which converts line breaks into paragraphs. An attacker can submit a crafted comment containing a line break within the cite attribute of a blockquote tag. While this input passes the wp kses() filter, a subsequent reformatting step during page display uses an incorrect regular expression that inserts a paragraph tag inside the quote, transforming the text into an active onfocus event handler triggered by an autofocus script.

This XSS executes automatically upon page load without user interaction. If a logged-in administrator views the affected page, the script can abuse the administrator's session to read a plugin installer nonce and upload a malicious PHP plugin, resulting in remote code execution (RCE) on the server. There is currently no evidence of real-world exploitation.

Recommendations Update WordPress to version 7.1.1 or the corresponding patched version for the specific branch (e.g., 4.7.36). Disable comments site-wide as a temporary mitigation. Enforce strict Content Security Policy (CSP) headers to block inline scripts. Ensure administrator users do not browse the front-end of the site while logged in.