Comment2Shell

Comment2Shell Comment2Shell is an end-to-end proof-of-concept for CVE-2026-93485, a pre-authentication stored XSS in WordPress core wpautop that escalates to remote code execution inside an administrator session. An anonymous comment plants the payload; when an admin opens the post, the browser...

Exploit for CVE-2026-93485

Comment2Shell Comment2Shell is an end-to-end proof-of-concept...

PT-2026-95257

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7 through 7.1 Description An unauthenticated stored cross-site scripting XSS issue, dubbed Comment2Shell, exists in the WordPress core. The flaw occurs in the wpautop function, which converts line breaks into paragraphs. A...