{"id":"CVE-2026-93485","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cwe":["CWE-79"],"vendor":"Automattic","product":"WordPress","affected":["WordPress >= 7.1 < 7.1.1","WordPress >= 7.0 <= 7.0.4","WordPress >= 6.9 <= 6.9.7","WordPress >= 6.8 <= 6.8.8","WordPress >= 6.7 <= 6.7.7","WordPress >= 6.6 <= 6.6.7","WordPress >= 6.5 <= 6.5.10","WordPress >= 6.4 <= 6.4.10","WordPress >= 6.3 <= 6.3.10","WordPress >= 6.2 <= 6.2.11","WordPress >= 6.1 <= 6.1.12","WordPress >= 6.0 <= 6.0.14","WordPress >= 5.9 <= 5.9.16","WordPress >= 5.8 <= 5.8.15","WordPress >= 5.7 <= 5.7.17","WordPress >= 5.6 <= 5.6.19","WordPress >= 5.5 <= 5.5.20","WordPress >= 5.4 <= 5.4.21","WordPress >= 5.3 <= 5.3.23","WordPress >= 5.2 <= 5.2.26","WordPress >= 5.1 <= 5.1.24","WordPress >= 5.0 <= 5.0.27","WordPress >= 4.9 <= 4.9.31","WordPress >= 4.8 <= 4.8.30","WordPress >= 4.7 <= 4.7.35"],"published":"2026-09-18","updated":"2026-10-17","sourceUpdated":"2026-10-17T09:16:29.070","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93485","references":[{"url":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve","label":"audit@patchstack.com"},{"url":"https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/","label":"audit@patchstack.com"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00749,"epssPercentile":0.54724,"exploits":{"github":4,"githubRepos":["https://github.com/DeathShotXD/Comment2Shell","https://github.com/686f6c61/POC-WP-CORE-CVE-2026-93485","https://github.com/HORKimhab/CVE-2026-93485"],"nuclei":["CVE-2026-93485"],"checkedAt":"2026-10-27T21:58:35.471Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-19T13:21:30.559066Z"},"ingestedAt":"2026-09-18T06:36:37.989Z","slug":"CVE-2026-93485","body":"## Overview\n\nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":209517,"id":"CVE-2026-93485","ts":1790149898854,"field":"exploit_available","old":"false","new":"true"}]}