WordPress Core Stored XSS Vulnerability Enables Remote Code Execution via Admin Session

A stored cross-site scripting vulnerability in WordPress core, identified as CVE-2026-93485 and dubbed "Comment2Shell," was publicly disclosed and patched on September 17, 2026. The vulnerability allowed anonymous visitors to post comments containing malicious scripts. These scripts were stored in the comments database and would execute in the browser of any user who viewed the comment page.

The impact was particularly severe for sites with administrative users: when a logged-in administrator viewed a comment page containing the stored payload, the script executed within their browser session. This could potentially allow the attacker to perform actions with administrator privileges, exfiltrate data, or achieve remote code execution on the server, depending on the site's configuration and additional security controls.

WordPress version 7.1.1, released on September 17, 2026, contains the fix for this vulnerability. The WordPress security team advised all site owners to update immediately to the latest version. As a best practice, administrators should ensure WordPress core, themes, and plugins are kept up to date, and consider restricting comment functionality where not required for site operations.

The vulnerability was discovered and reported in September 2026, with public disclosure and the release of the patch occurring on September 17, 2026. No public exploitation was confirmed prior to the patch release, though the attack chain involving stored XSS leading to administrator compromise is technically plausible.