Vulnerabilities CVE-2026-93485 CVE-2026-93485 WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
Scores CVSS Score Vector Source 3.1 7.1 High CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Patchstack
Weaknesses CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected Products Product Versions WordPress Automattic
7.1 Affected 7.0 through 7.0.4 Affected from 7.0.5 Not affected 6.9 through 6.9.7 Affected from 6.9.8 Not affected 6.8 through 6.8.8 Affected from 6.8.9 Not affected 6.7 through 6.7.7 Affected from 6.7.8 Not affected 6.6 through 6.6.7 Affected from 6.6.8 Not affected 6.5 through 6.5.10 Affected from 6.5.11 Not affected 6.4 through 6.4.10 Affected from 6.4.11 Not affected 6.3 through 6.3.10 Affected from 6.3.11 Not affected 6.2 through 6.2.11 Affected from 6.2.12 Not affected 6.1 through 6.1.12 Affected from 6.1.13 Not affected 6.0 through 6.0.14 Affected from 6.0.15 Not affected 5.9 through 5.9.16 Affected from 5.9.17 Not affected 5.8 through 5.8.15 Affected from 5.8.16 Not affected 5.7 through 5.7.17 Affected from 5.7.18 Not affected 5.6 through 5.6.19 Affected from 5.6.20 Not affected 5.5 through 5.5.20 Affected from 5.5.21 Not affected 5.4 through 5.4.21 Affected from 5.4.22 Not affected 5.3 through 5.3.23 Affected from 5.3.24 Not affected 5.2 through 5.2.26 Affected from 5.2.27 Not affected 5.1 through 5.1.24 Affected from 5.1.25 Not affected 5.0 through 5.0.27 Affected from 5.0.28 Not affected 4.9 through 4.9.31 Affected from 4.9.32 Not affected 4.8 through 4.8.30 Affected from 4.8.31 Not affected 4.7 through 4.7.35 Affected from 4.7.36 Not affected
Every record here comes from the CVE Program’s CVE List . © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use .
