Comment2Shell

Comment2Shell Comment2Shell is an end-to-end proof-of-concept for CVE-2026-93485, a pre-authentication stored XSS in WordPress core wpautop that escalates to remote code execution inside an administrator session. An anonymous comment plants the payload; when an admin opens the post, the browser...

Exploit for CVE-2026-93485

Comment2Shell Comment2Shell is an end-to-end proof-of-concept...

CVE-2019-20042: Improper Neutralization of Input During Web Page Generation

In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wptargetedlinkrel can be used in a particular way to result in a stored cross-site scripting XSS vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a mino...

Wordpress 3.9.2 /wp-includes/formatting.php 跨站脚本漏洞

No description provided by source...

CVE-2011-4957

The makeclickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service crash via a comment with a crafted URL that triggers many recursive calls...

CVE-2011-4957: Improper Input Validation

The makeclickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service crash via a comment with a crafted URL that triggers many recursive calls...

CVE-2012-2403

wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

CVE-2012-2403

WordPress: CVE-2012-2403 affects wp-includes/formatting.php in WordPress prior to 3.3.2, where clickable links inside HTML attributes enable cross-site scripting (XSS) via unspecified vectors. The underlying issue is improper handling of links in attributes, allowing injected scripts to execute i...

CVE-2012-2403: Improper Neutralization of Input During Web Page Generation

wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

PT-2012-4016

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.3.2 Description The issue makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors, due to an attempt to enable clickable links inside attributes in the...