---
id: 8835
title: "[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core"
cve: CVE-2026-93485
source_domain: idnsec.com
source_url: "https://idnsec.com/research/comment2xss-zero-click-pre-auth-xss-to-rce-in-wordpress-core/"
published_at: "2026-09-21T00:00:00Z"
tags: ["rce", "vulnerability-research", "wordpress", "xss", "pre-auth", "vulnerability", "stored-xss", "zero-click", "wordpress-core", "wordpress-7-1-1", "unauthenticated-xss", "wpautop", "kses", "wptexturize", "block-theme", "comment2shell", "cve-2026-93485"]
phying_url: "https://phying.com/item/8835"
lang: en
---

# [CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core

## Summary

An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.

## Intelligence Metadata

- **Sources:** idnsec.com
- **CVE:** CVE-2026-93485
- **Published:** 2026-09-21T00:00:00Z
- **Original:** https://idnsec.com/research/comment2xss-zero-click-pre-auth-xss-to-rce-in-wordpress-core/
- **Phying News:** https://phying.com/item/8835