Security Alert Summary
A DOM-based cross-site scripting (XSS) vulnerability exists in Automattic WordPress core that can be triggered on a default installation. The issue allows unsanitized input to be used during page generation, enabling an unauthenticated attacker to inject client-side script under specific conditions related to comments and comment moderation bypass.
CVE Details
- CVE ID:
CVE-2026-93485 - Affected component: Automattic WordPress core
- Affected versions: WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.
- Published: September 18, 2026 at 06:16:41 AM UTC
- Last modified: September 18, 2026 at 01:23:37 PM UTC
- CVSS v3.1: Base Score 7.1, Severity HIGH, Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Authentication / Privileges / User interaction: No privileges required (PR:N); user interaction required (UI:R)
- Attack vector / Complexity / Scope: Network (AV:N); Low complexity (AC:L); Scope changed (S:C)
- Impact: Confidentiality: Low; Integrity: Low; Availability: Low
- CWE: CWE-79
Technical Details
The vulnerability is an improper neutralization of input during web page generation that leads to DOM-based cross-site scripting (XSS). In this case, user-supplied input can reach the page DOM without sufficient sanitization or encoding, allowing injected script to execute in the context of visitors’ browsers.
The report describes an unauthenticated stored XSS that can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the mechanism requiring a commenter to have a previously approved comment can be bypassed. These factors allow an attacker to submit payloads via the comment system that are later rendered and executed in other users’ browsers.
Because the vulnerability is DOM-based, the injected code runs client-side in the victim’s browser and can perform any actions available to that browser context, such as reading or modifying DOM-visible data and initiating requests that the user is permitted to make. The issue does not inherently imply direct server takeover, but it can expose session-related data or perform actions on behalf of authenticated users in their browsers.
How This Could Impact Your Website
Consider a scenario where a site owner maintains a public blog with multiple contributors and external contractors who moderate comments. An attacker posts a crafted comment that includes a DOM XSS payload. When an editor or a logged-in staff member views the post, the injected script can run in their browser and may expose information visible to that user, such as internal email addresses shown in the author or comment list, or perform actions that the viewer can perform in the site UI.
Practical consequences include exposure of internal user email addresses and an increased risk of targeted phishing or social engineering against staff or contributors who have elevated privileges. These outcomes can aid follow-up attacks even if the vulnerability itself is limited to client-side script execution. If you are unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Apply updates to WordPress to a non-affected version as soon as an appropriate patch or maintenance release is available.
- Review and reduce unnecessary user roles, especially contributor and commenter permissions.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Disable or tighten comment settings if comments are not required; enable moderation and stricter filtering where appropriate.
- Remove unused or unmaintained plugins and themes that increase attack surface.
- Monitor site activity and logs for unusual behavior, including unexpected comment submissions or administrative actions.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
