WordPress CVE-2026-93485: Stored XSS in Core, Update to 7.1.1

WordPress just shipped a fix for a flaw in its own code, not in a plugin, and that distinction is the whole story. CVE-2026-93485 is a stored cross-site scripting bug in wpautop(), the function that turns line breaks into paragraphs on nearly every WordPress install. An unauthenticated visitor can carry the payload in a comment, and it runs when that comment is displayed. Patchstack, which assigned the CVE, rates it 7.1 on the high band. The fix landed in WordPress 7.1.1 on September 17, 2026, and was backported to every supported branch.

Most WordPress cross-site scripting bugs live in a plugin or theme, so they only touch the sites running that add-on. This one sits in a core formatting path that runs whether you have ten plugins or none, and it reaches back through every branch to 4.7. That reach is what makes an otherwise mid-severity comment bug worth acting on today.

A comment that runs when it is shown

The mechanics are the classic stored-comment problem, moved into core. An attacker submits a comment containing a script payload. wpautop() processes it for display, and the browser runs it in the context of the page. WordPress rates the flaw as needing no privileges but requiring a user to load the page, and its own release note describes the issue as "subject to comment approval." In plain terms: the script fires when the comment is rendered, which on a default site means after a moderator approves it, and on a site that auto-approves comments, sooner.

One detail in the scoring is the part to sit with: the flaw carries a scope change, meaning the injected script crosses out of the comment into another security context. Stored cross-site scripting is dangerous less for what it does to an anonymous reader and more for what it does when a logged-in administrator opens the page and the script runs inside their authenticated session. That is the path from a throwaway comment to a hijacked admin action. The vulnerability was reported by Rafie Muhammad of Awesome Motive.

Who is exposed

Every branch back to 4.7 carries the flaw, right up to the 7.1.1 release that closes it. WordPress backported the fix across supported branches, so the version you move to depends on the branch you run.

Cross-site scripting is the single most common flaw class our threat desk has logged over the last 90 days, 2,323 of them. The vast majority are in plugins and themes. A core entry in that count is the rarer and more widely reachable case, because the affected code ships with WordPress itself rather than with something you chose to install.

The patch reaches most sites on its own. Not the ones you run.

WordPress installs minor and security releases automatically by default, so a large share of the internet's WordPress sites will take 7.1.1 within hours without anyone touching them. That is genuinely good, and it is why a comment bug like this does not become a mass-exploitation event the way an unauthenticated remote code execution flaw does.

The gap is the fleet our readers operate. Managed hosts pin core versions. Sites deployed through Composer or git turn background updates off. Management plugins and staging workflows defer updates on a schedule. On those installs the fix does not arrive by itself, and "WordPress auto-updates, so we are fine" is exactly the assumption that leaves a pinned 6.4 site sitting on the flaw. Verify the running version rather than trust the default.

Check the moderation queue before you approve anything

Because the payload lives in a comment and fires on display, your moderation queue is both the exposure and the detection surface. Before approving a backlog of pending comments, look for script-like markup sitting in wp_comments. A read-only query surfaces the obvious candidates:

SELECT comment_ID, comment_author, comment_date
FROM wp_comments
WHERE comment_approved = '0'
  AND (comment_content LIKE '%<script%'
    OR comment_content LIKE '%javascript:%'
    OR comment_content LIKE '%onerror=%'
    OR comment_content LIKE '%onload=%');

Adjust wp_ to your table prefix. A hit is not proof of an attack, comment spam is full of junk, but a pending comment carrying ``, an onerror handler, or a javascript: URL is one to delete rather than approve. Watching for unexpected changes to core files with file integrity monitoring, and folding comment-content anomalies into routine threat hunting, turns this from a one-time cleanup into something you would catch next time.

Confirm your version, then clear the comment queue

Open Dashboard, then Updates, and confirm you are on 7.1.1 or the backported release for your branch from the table above. If core is pinned by your host or a management plugin, apply the branch fix by hand rather than waiting for a background update that is switched off. Then work the moderation queue: purge anything carrying script markup, and hold off on bulk-approving comments until you are patched. This sits alongside the steady drip of comment-borne WordPress bugs we have tracked, from a LiteSpeed Cache comment XSS to an unauthenticated stored XSS in Bookly. The difference this time is that the flaw is in core, so the answer is a core update, not a plugin one.