CVE-2026-93485

Executive Summary

CVE-2026-93485 is an unauthenticated stored cross-site scripting (XSS) vulnerability in the WordPress core, arising from improper neutralization of input during web page generation (CWE-79). The flaw is reproducible on a default WordPress installation because comment moderation is disabled by default and the requirement for commenters to have a previously approved comment can be bypassed, enabling an unauthenticated attacker to inject a persistent payload. The vulnerability affects an extremely broad version range — every major WordPress branch from 4.7 through 7.1 — giving it a very large blast radius across internet-facing deployments; successful exploitation affects other users' browsers (scope change) with low confidentiality, integrity, and availability impact, yielding a CVSS 3.1 base score of 7.1 (High).

Technical Analysis

The CNA/NVD description classifies this as "Improper neutralization of input during web page generation ('cross-site scripting')" and, in the same record, states it "allows DOM-Based XSS." There is an internal tension in the provided data: DOM-based XSS typically executes in the client from unsafe JavaScript sinks, whereas the narrative portion of the record describes what is explicitly labeled an "Unauthenticated Stored XSS vulnerability in the WordPress core." The report treats the confirmed, reproducible behavior as described: attacker-supplied input is stored and later rendered into a web page without adequate neutralization, causing script execution in the context of the victim's session.

The most reliable technical facts derivable from the supplied data are:

1. Unauthenticated injection path. No authentication (PR:N) is required. The record explicitly states comment moderation is disabled by default and that the requirement for a commenter to have a previously approved comment "can be bypassed," meaning the normal anti-abuse gate does not prevent injection.
2. Stored, not merely reflected. The record labels the flaw Stored XSS ("can be reproduced on a default WordPress installation"), so the payload persists server-side and is served to subsequent visitors or to administrators viewing comment content.
3. Default configuration is sufficient. No non-default plugin, theme, or setting is required, which is why the affected version list spans dozens of releases.

No specific function names, REST/API endpoints, parameter names, file paths, or code snippets are provided in the source description. Accordingly, no such identifiers are asserted in this report. The exact injection point within the comment-submission or comment-rendering pipeline is not specified in the available data, and — per accuracy constraints — is not fabricated here. From a vulnerability-class standpoint, the mechanism is: insufficient output encoding/sanitization of user-controlled comment data at render time, combined with an abuse-enabling default configuration (moderation off, prior-approval bypass), producing persistent script execution for any user who views the poisoned content.

Because the CVSS vector carries S:C (scope changed) with C:L/I:L/A:L, the flaw can affect resources beyond the vulnerable component's security authority — consistent with script executing in the browser of a victim (including a higher-privileged administrator) rather than impacting only the WordPress server process itself.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available; the attack chain below is inferred strictly from the vulnerability class described in the NVD record.

1. Reconnaissance / target identification. The attacker identifies a WordPress site running an affected branch (4.7 through 7.1). WordPress is trivially fingerprintable via static asset paths and generator metadata; affected sites are enumerated at scale using web-search/Shodan-style dorks (see METADATA). No credentials or prior interaction are needed.
2. Triggering the flaw class. Acting as an unauthenticated visitor, the attacker submits crafted input through the site's comment-submission mechanism. Because comment moderation is disabled by default and the "previously approved comment" requirement can be bypassed, the submission is not held for review and no established trust is needed. The payload is stored server-side (stored XSS).
3. Payload/execution (class level). When any user — including an administrator reviewing comments or any visitor loading the affected page — renders the stored content, the insufficiently neutralized input is interpreted as markup/script by the browser, and attacker-controlled script executes in that user's session context. (The record additionally describes the class as DOM-based XSS; in that variant, execution occurs client-side via an unsafe JavaScript sink. The specific sink is not disclosed in the provided data and is not invented here.)
4. Post-exploitation impact. With S:C, the script runs with the victim's privileges on the target origin. Realistic consequences of this vulnerability class include session/token theft, performing authenticated actions as the victim (e.g., administrative actions if an admin views the payload), redirecting users to malicious infrastructure, or establishing persistence in the victim's browser context. The CVSS vector caps direct confidentiality/integrity/availability impact at Low, reflecting limited direct system impact but meaningful downstream risk through the compromised user session.

No evidence of active exploitation, exploitation in the wild, or threat-actor association is provided in the dataset. CISA KEV status is NO.

Impact Assessment

• Affected population: Any site running WordPress core versions in the listed ranges — effectively the entire mainstream WordPress install base from 4.7 up to and including 7.1 (unfixed). This is an unusually broad version span, meaning organizations that have deferred core updates across multiple major branches are all exposed.
• Attack prerequisites: None beyond network reachability of the site and a victim user (UI:R required for script execution); no authentication, no user interaction on the attacker's side, no prior comment approval.
• CVSS subscores: AV:N (remotely exploitable), AC:L (no special conditions), PR:N (unauthenticated), UI:R (victim must render the content), S:C (impacts beyond the vulnerable component — victim browser context), C:L/I:L/A:L (limited direct impact per vector).
• Blast radius: Default-configuration sites are affected, so exposure is not limited to misconfigured deployments. The stored nature means a single injected payload can impact many users over time, including privileged administrators, which is the highest-value outcome in this class (potential privilege escalation via admin session compromise).
• Business impact: For enterprises, risk includes administrative account takeover chains, content defacement/redirects affecting brand trust, drive-by delivery of further malware to visitors, and downstream compromise of reused credentials. Because no patch currently exists (patch confidence 0/4), exposure is open-ended.
• EPSS: Not yet scored by FIRST.org — no numeric EPSS value is asserted.

Detection Guidance

Sigma Rule

title: WordPress Core Unauthenticated Stored XSS via Comment Submission (CVE-2026-93485)
id: 3f9c1a2e-7b4d-4c88-9e21-0a5b6c7d8e9f
status: experimental
description: Detects unauthenticated comment submissions to WordPress containing script-bearing payloads indicative of stored XSS exploitation attempts (CVE-2026-93485).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93485
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.79
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: '/wp-comments-post.php'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'document.cookie'
  condition: selection_method and selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Security scanners and pen-test tooling
  - Legitimate comments containing code samples
level: high

YARA Rule

rule CVE_2026_93485_WordPress_Stored_XSS
{
    meta:
        description = "Detects stored XSS payload patterns injected through WordPress comment submission (CVE-2026-93485)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93485"
        date = "2026-01-01"
        cwe = "CWE-79"

    strings:
        $s1 = "<script" nocase
        $s2 = "javascript:" nocase
        $s3 = "onerror=" nocase
        $s4 = "onload=" nocase
        $s5 = "document.cookie" nocase
        $s6 = "wp-comments-post.php" nocase
        $img_tag = "<img" nocase
        $svg_tag = "<svg" nocase

    condition:
        uint16(0) == 0x3C3F or any of ($s*) or
        (1 of ($img_tag, $svg_tag) and 1 of ($s3, $s4))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93485 WordPress Core Unauthenticated Stored XSS Comment Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"wp-comments-post.php"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"<svg"; nocase; http.request_body; content:"onerror"; nocase; classtype:web-application-attack; reference:cve,2026-93485; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93485; sid:202693485; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST"
      and stringContains(http.request.body, "wp-comments-post.php") ]
  [ network where network.protocol == "http"
      and ( stringContains(http.request.body, "<script")
         or stringContains(http.request.body, "javascript:")
         or stringContains(http.request.body, "onerror=")
         or stringContains(http.request.body, "onload=")
         or stringContains(http.request.body, "document.cookie") ) ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx OR sourcetype=iis
| eval raw=coalesce(uri_query, uri, cs_uri_query, url)
| eval body=coalesce(request_body, http_request_body, cs_uri_query)
| where (match(raw, "(?i)wp-comments-post\.php") OR match(body, "(?i)wp-comments-post\.php"))
| where match(body, "(?i)<script|javascript:|onerror\s*=|onload\s*=|document\.cookie|<svg|<img[^>]+onerror")
| stats count min(_time) as first_seen max(_time) as last_seen values(body) as payload by src_ip, host, url
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,wordpress,">
  <rule id="202693485" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">wp-comments-post\.php</field>
    <regex field="body">(?i)(<script|javascript:|onerror\s*=|onload\s*=|document\.cookie|<svg)</regex>
    <description>CVE-2026-93485: Potential WordPress core unauthenticated stored XSS comment submission detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_93485,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, there is no vendor fix, and no official workaround is documented. The absence of a fix makes compensating controls and detection the primary defenses.

1) Immediate mitigations (no vendor patch available):

• Enable comment moderation for all comments and disable the "previously approved comment" auto-approval behavior, directly countering the two default conditions the record credits with enabling reproduction.
• Temporarily disable comments site-wide if they are not operationally required.
• Deploy a Web Application Firewall (WAF) / reverse-proxy filter with rules targeting script-bearing and event-handler payloads in comment submissions (e.g., <script, javascript:, onerror=, onload=, <svg, <img ... onerror).
• Enforce a strict Content-Security-Policy (CSP) to reduce script-execution impact and constrain document.cookie access via HttpOnly cookies.
• Restrict admin browsing of untrusted comment content where feasible; consider requiring administrators to review comments in a hardened/isolated browser context.

2) Patch/upgrade steps:

• No patched version is available. Monitor the WordPress security release channels and NVD entry for CVE-2026-93485 for an official fixed release. The record indicates fixes would land in the corresponding maintenance releases above each affected branch (e.g., "7.1 before 7.1.1"), but no such fix is currently confirmed by any tracked source — do not assume any listed version is fixed.
• When a patch is published, apply it to core immediately across every affected installation; treat all listed branches as vulnerable until a vendor advisory confirms otherwise.

3) Long-term hardening:

• Establish a routine, rapid patch cadence for WordPress core; the breadth of this version range demonstrates the cost of deferred updates.
• Harden comment settings by default across the fleet (moderation on, approval requirements enforced, rate limiting on submissions).
• Adopt defense-in-depth: CSP, HttpOnly/Secure cookie flags, centralized web-log collection feeding the detections above, and WAF virtual patching as a bridge for unpatched windows.
• Inventory and continuously track WordPress core versions to identify which installations fall within the affected ranges.

References

1. NVD — CVE-2026-93485: https://nvd.nist.gov/vuln/detail/CVE-2026-93485
2. MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
3. WordPress Security Releases (monitor for CVE-2026-93485 fix): https://wordpress.org/news/category/security/
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-93485 not listed as of report generation): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor note: No public PoC, exploit code, Nuclei template, or evidence of active exploitation is present in the supplied dataset. CISA KEV status is NO. EPSS is not yet scored by FIRST.org. This report contains no fabricated indicators and should be re-validated as vendor and threat-intelligence data become available.