BREAKING: WordPress comment XSS lets strangers plant script (7.1.1)

An unauthenticated visitor can leave stored script in WordPress through comment formatting, and WordPress just shipped 7.1.1 to stop that path. The CVE List entry is CVE-2026-93485 (Patchstack): DOM-based / stored XSS in core paragraph formatting. WordPress.org’s own security notes say the issue is unauthenticated stored XSS via paragraph formatting, subject to comment approval. The same short-cycle release also closes ten other security bugs. Treat 7.1.1 as an emergency upgrade for any site still on 7.1 or older supported branches.

This is the operator write-up for the WordPress 7.1.1 security train. The HOL Guard evidence pack for CVE-2026-93485 is the source record. Do not open a second blog post for the other fixes in this same upgrade.

What breaks

WordPress published WordPress 7.1.1 Maintenance and Security Release (dated 2026-09-17 on the news post; CVE-2026-93485 published 2026-09-18). Official wording credits Rafie Muhammad (Awesome Motive) for stored XSS in wpautop() that lets an unauthenticated visitor inject script, subject to comment approval. Patchstack’s CVE text adds that a default install can reproduce the unauthenticated stored XSS path: comment moderation is off by default, and the “must have a previously approved comment” gate can be bypassed.

Affected trains named in the CVE: WordPress 7.1 before 7.1.1, plus older lines through the usual security-backport range (7.0.x through 4.7.x as listed in the CVE). Fixed for the current line: 7.1.1. Patchstack marks the issue CVSS 7.1 (High) with unauthenticated required privilege and user interaction required for full impact.

CVE-2026-93485 is not the only reason to move. The same 7.1.1 release lists 11 security fixes, including (paraphrased from WordPress.org, not separate CVE IDs unless you have them):

• Crafted URL that can install and preview an inactive theme from WordPress.org
• Stored XSS in some themes that support custom headers
• HTML API set_modifiable_text() comment break-out
• Contributor+ arbitrary post overwrite
• Authenticated path traversal in the REST templates controller
• XML-RPC path that can publish customize_changeset posts bypassing edit_css
• Site Administrator network-activating a network-only plugin (multisite)
• Missing read_post check leaking a private parent-post title
• Contributor+ draft/pending post slug disclosure
• Any authenticated user reparenting comments (including notes)

WordPress.org recommends updating immediately because this is a security release. Automatic background updates will pick it up where enabled.

Who is not in scope

Sites already running WordPress 7.1.1 (or the matching security backport for your branch once it lands) are outside CVE-2026-93485. Static HTML, headless frontends that never render WordPress comments, and installs with comments fully closed remove the comment-injection path for this CVE, but they are not a substitute for the 7.1.1 binary if you still run core PHP for admin, REST, XML-RPC, or themes. Multisite-only items in the 11-fix list do not apply to single-site installs. Non-WordPress CMSes are out of scope.

How to check

On every WordPress host (and every container image that embeds core):

# WP-CLI
wp core version
wp core check-update

# or from PHP in the site root
php -r 'require "wp-includes/version.php"; echo $wp_version, "\n";'

Confirm the printed version is 7.1.1 or newer on the 7.1 line (or the patched build for your older branch after backports ship). In wp-admin: Dashboard → Updates should show 7.1.1 available or already installed. Also note whether comments are open on public posts (wp option get default_comment_status) and whether moderation is required. Those settings change how easy the CVE-2026-93485 path is to hit; they do not replace the core upgrade.

How to fix

Upgrade WordPress to 7.1.1 (or the security build for your supported branch) and verify the version string afterward:

# WP-CLI (preferred)
wp core update --version=7.1.1
wp core update-db
wp core version

# or Dashboard → Updates → Update Now
# or download https://wordpress.org/wordpress-7.1.1.zip

If you run multiple sites from one image, rebuild and redeploy the image rather than patching only one container. After upgrade, spot-check a public post with comments: submit a benign test comment and confirm it still behaves under your moderation policy. Review recent pending/approved comments for unexpected markup while you are there. WordPress notes security backports for older branches (through 4.7) are in progress; do not wait on a backport if you can move the current line to 7.1.1 now.

What this is not

This is not remote code execution and not an unauthenticated admin takeover. CVE-2026-93485 is stored / DOM XSS: an attacker plants script that runs in a visitor’s or moderator’s browser when the poisoned content is viewed. WordPress.org’s advisory ties the unauthenticated path to comment approval. It is not “every WordPress site is already owned,” and it is not limited to one obscure plugin. It is core, same-week, with an official “update immediately” security release that also closes ten other issues. Upgrade first; argue severity later.

References

• WordPress 7.1.1 Maintenance and Security Release
• WordPress 7.1.1 HelpHub / version notes
• CVE-2026-93485 (CVE Program)
• Patchstack entry for CVE-2026-93485
• HOL Guard pack CVE-2026-93485