Novel Attack Vector to Bypass CSP Via Same Origin Method Execution (Wordpress Zeroday)

An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.

Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.

A detailed walkthrough of chaining XSS with CSP bypasses and Electron misconfigurations to achieve full remote code execution on the Discord Desktop client, with lessons for Electron app hardening.

A HackerOne blog post (page no longer accessible) reporting how much organizations paid hackers for the ten most rewarded vulnerability types over one year.

HackerOne names p4fg and manoelt winners of the h1-415 CTF, sending them to the San Francisco live hacking event; the challenge saw 47 million requests, 35 account takeovers and 18 CSP bypasses.

A SQLi bug forced an emergency WordPress core patch in July (fixed in 7.0.2 / 6.9.5); the post argues SQL injection persists, backing it with advisory data and defense notes.