CVE-2026-93485: WordPress Core DOM-Based XSS Vulnerability

CVE-2026-93485 Overview

CVE-2026-93485 is a DOM-based cross-site scripting (XSS) vulnerability in Automattic WordPress core. The flaw stems from improper neutralization of input during web page generation [CWE-79]. Attackers can exploit the issue on a default WordPress installation without authentication, because comment moderation is disabled by default and the previously-approved-comment requirement can be bypassed. The vulnerability affects a broad range of WordPress versions, from 4.7 through 7.1, and is fixed in WordPress 7.1.1.

Critical Impact
Unauthenticated attackers can inject malicious script content through the comment surface. The stored payload executes in the browsers of site visitors and administrators, enabling session theft, forced actions, and site defacement.

Affected Products

WordPress core 7.1 before 7.1.1, and all 7.0.x, 6.9.x, 6.8.x, 6.7.x, 6.6.x, 6.5.x, 6.4.x, 6.3.x, 6.2.x, 6.1.x, and 6.0.x branches up to their latest listed patch levels
WordPress core 5.9.x through 5.0.x branches up to their latest listed patch levels
WordPress core 4.9.x, 4.8.x, and 4.7.x branches through 4.9.31, 4.8.30, and 4.7.35

Discovery Timeline

2026-09-18 - CVE-2026-93485 published to the National Vulnerability Database
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-93485

Vulnerability Analysis

The vulnerability is a DOM-based XSS flaw in WordPress core comment handling. Attacker-controlled input reaches a client-side sink without proper neutralization, allowing script execution in a victim's browser context. Because the flaw exists in core, every default installation of an affected version is exposed on the public comment surface.

Unauthenticated exploitation is possible because default WordPress configuration does not require comment moderation. The safeguard that requires a commenter to have a prior approved comment can also be bypassed, removing the usual gating between attacker input and rendered pages.

The scope-changed nature of the flaw means script execution occurs in a security context beyond the vulnerable component, affecting site visitors and privileged users who view the poisoned page. Session cookies, administrative actions, and content integrity are all reachable through a successful payload.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. WordPress core fails to correctly sanitize or encode data before it is written into a DOM sink used to render comment content, allowing HTML and JavaScript delivered by the attacker to be interpreted as code.

Attack Vector

An attacker submits a crafted comment containing script content to a target WordPress site over the network. No authentication is required. User interaction is limited to visiting the page that renders the malicious comment, which occurs during ordinary browsing or moderation. When the comment is processed client-side, the payload executes in the visitor's browser, giving the attacker access to the same origin as the WordPress site.

For technical details, review the Patchstack XSS Vulnerability Report and the WordPress 7.1.1 Security Release announcement.

Detection Methods for CVE-2026-93485

Indicators of Compromise

Comments in wp_comments containing <script>, onerror=, onload=, javascript:, or encoded variants such as <script>
Unexpected outbound requests from visitor browsers to attacker-controlled domains referenced from a WordPress page
New administrator accounts, altered user roles, or unexpected plugin installations following comment activity
Anonymous or newly registered accounts posting comments containing HTML tags or long obfuscated strings

Detection Strategies

Query the WordPress database for comment content matching XSS payload patterns and review historical comment revisions
Deploy a Content Security Policy (CSP) in report-only mode and monitor violation reports for inline script attempts on comment pages
Correlate web server access logs for POST requests to wp-comments-post.php with abnormal body sizes or scripting keywords
Alert on WordPress core running versions below 7.1.1 or below the latest patch level of each supported branch

Monitoring Recommendations

Ingest WordPress access, audit, and database logs into a centralized data lake for continuous review of comment submission and admin activity
Monitor administrator session events for unusual source IPs, geolocations, or user-agent strings after comment interaction
Track file integrity of wp-content and core files to identify follow-on modifications caused by hijacked admin sessions

How to Mitigate CVE-2026-93485

Immediate Actions Required

Upgrade WordPress core to 7.1.1 or the latest patched release on your current branch as published in the WordPress 7.1.1 Security Release
Audit existing comments for stored payloads and remove or sanitize any suspicious entries before restoring public access
Rotate administrator and privileged user credentials, and invalidate active sessions after patching
Review recently created accounts, plugins, and themes for unauthorized changes tied to the exposure window

Patch Information

Automattic addresses CVE-2026-93485 in WordPress 7.1.1 and corresponding maintenance releases across supported branches. Enable automatic background updates for minor releases where possible, and validate that the WordPress core version reported in the admin dashboard reflects the patched build.

Workarounds

Enable the "Comment must be manually approved" setting under Settings → Discussion to prevent unmoderated comments from rendering
Disable comments globally on posts and pages if moderation cannot be enforced
Deploy a Web Application Firewall (WAF) rule that blocks script-related tokens in POST bodies to wp-comments-post.php
Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Configuration example: enforce comment moderation via WP-CLI
wp option update comment_moderation 1
wp option update comment_previously_approved 1
wp option update default_comment_status closed

# Verify current WordPress core version
wp core version