From Informational to Critical: Chaining & Elevating Web Vulnerabilities

Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.

An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.

Fuzzing Android devices uncovered CVE-2016-3861 in libutils, a severe bug reachable from many attack vectors and usable for remote code execution and elevation into the system_server SELinux domain.

A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.

Lars Sorenson explores NodeJS sandbox escapes, walking through reverse shell techniques and methods to regain require functionality when sandboxes block module imports, based on interpreter internals.

Cody Wass recounts discovering an XXE vulnerability in a service behind IBM's MaaS360 MDM platform, with a primer on external XML entities and how parser abuse enables file reads and SSRF.