CVE-2026-93485
🗓️ 18 Sep 2026 06:00:05Reported by PatchstackType 
cve🔗 web.nvd.nist.gov📰️ 11 Media mentions👁 122 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 22 |
|---|---|---|---|---|
 | Exploit for CVE-2026-93485 | 25 Sep 202600:13 | – | githubexploit |
| Exploit for CVE-2026-93485 | 26 Sep 202612:34 | – | githubexploit |
 | The vulnerability of the WordPress website content management system’s kernel lies in the lack of measures taken to protect the structure of web pages, allowing attackers to execute arbitrary code. | 24 Sep 202600:00 | – | bdu_fstec |
 | CVE-2026-93485 | 18 Sep 202606:33 | – | circl |
 | CVE-2026-93485 WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability | 18 Sep 202606:00 | – | cvelist |
 | [SECURITY] [DSA 6525-1] wordpress security update | 28 Sep 202618:41 | – | debian |
 | CVE-2026-93485 | 18 Sep 202606:00 | – | debiancve |
 | Debian dsa-6525 : wordpress - security update | 29 Sep 202600:00 | – | nessus |
| Linux Distros Unpatched Vulnerability : CVE-2026-93485 | 18 Sep 202600:00 | – | nessus |
 | EUVD-2026-82657 | 18 Sep 202606:00 | – | euvd |
10
Node
OR
[
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "7.1",
"lessThan": "7.1.1",
"changes": [
{
"at": "7.1.1",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "7.0",
"lessThanOrEqual": "7.0.4",
"changes": [
{
"at": "7.0.5",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.9",
"lessThanOrEqual": "6.9.7",
"changes": [
{
"at": "6.9.8",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.8",
"lessThanOrEqual": "6.8.8",
"changes": [
{
"at": "6.8.9",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.7",
"lessThanOrEqual": "6.7.7",
"changes": [
{
"at": "6.7.8",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.6",
"lessThanOrEqual": "6.6.7",
"changes": [
{
"at": "6.6.8",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.5",
"lessThanOrEqual": "6.5.10",
"changes": [
{
"at": "6.5.11",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.4",
"lessThanOrEqual": "6.4.10",
"changes": [
{
"at": "6.4.11",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.3",
"lessThanOrEqual": "6.3.10",
"changes": [
{
"at": "6.3.11",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.2",
"lessThanOrEqual": "6.2.11",
"changes": [
{
"at": "6.2.12",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.1",
"lessThanOrEqual": "6.1.12",
"changes": [
{
"at": "6.1.13",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "6.0",
"lessThanOrEqual": "6.0.14",
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.9",
"lessThanOrEqual": "5.9.16",
"changes": [
{
"at": "5.9.17",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.8",
"lessThanOrEqual": "5.8.15",
"changes": [
{
"at": "5.8.16",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.7",
"lessThanOrEqual": "5.7.17",
"changes": [
{
"at": "5.7.18",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.6",
"lessThanOrEqual": "5.6.19",
"changes": [
{
"at": "5.6.20",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.5",
"lessThanOrEqual": "5.5.20",
"changes": [
{
"at": "5.5.21",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.4",
"lessThanOrEqual": "5.4.21",
"changes": [
{
"at": "5.4.22",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.3",
"lessThanOrEqual": "5.3.23",
"changes": [
{
"at": "5.3.24",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.2",
"lessThanOrEqual": "5.2.26",
"changes": [
{
"at": "5.2.27",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.1",
"lessThanOrEqual": "5.1.24",
"changes": [
{
"at": "5.1.25",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "5.0",
"lessThanOrEqual": "5.0.27",
"changes": [
{
"at": "5.0.28",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "4.9",
"lessThanOrEqual": "4.9.31",
"changes": [
{
"at": "4.9.32",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "4.8",
"lessThanOrEqual": "4.8.30",
"changes": [
{
"at": "4.8.31",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Automattic",
"product": "WordPress",
"versions": [
{
"status": "affected",
"version": "4.7",
"lessThanOrEqual": "4.7.35",
"changes": [
{
"at": "4.7.36",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| comment | request body | /wp-comments-post.php | Stored XSS via comment content that renders in the page leading to payload execution (zero-click). | CWE-79 |
| action | query param | /update.php | Plugin upload path used to host a malicious plugin for RCE (update.php?action=upload-plugin). | CWE-79 |
| tab | query param | /wp-admin/plugin-install.php?tab=upload | Admin plugin-install page used to trigger plugin upload flow and obtain nonce; part of the exploitation chain. | CWE-79 |
10
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
19 Sep 2026 15:17Current
7.3High risk
Vulners AI Score7.3
CVSS 3.17.1
EPSS0.00375
SSVC