WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Linked advisories
- CVE-2026-93485WordPress: Mehrere Schwachstellen
- CVE-2026-93485Automattic WordPress: Cross-Site-Scripting (XSS)
- CVE-2026-93485Eine unzureichende Neutralisierung von Eingaben während der Erstellung von Webseiten ('Cross-Site-Scripting') führt zu einer DOM-basierten XSS-Schwachstelle im Automattic WordPress-Kern.
Affected vendors and products
More on WordPress
Other advisories
- HighCVE-2026-119977WordPress: Schwachstelle ermöglicht Codeausführung
- HighCVE-2026-66570Nickboss WordPress File Upload: Cross-Site-Scripting (XSS)
- HighCVE-2026-66570Nickboss WordPress File Upload: Cross-Site-Scripting (XSS)
- Not ratedhkcert:wordpress-multiple-vulnerabilities_20261102WordPress Multiple Vulnerabilities
- Not ratedosv:CLEANSTART-2025-GV56895Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2
- MediumCVE-2026-15272Shamalli Web 2.0 Directory plugin for WordPress: SQL-Injection
- MediumCVE-2026-15272Shamalli Web 2.0 Directory plugin for WordPress: SQL-Injection
- HighCVE-2026-110530Radgeek FeedWordPress: Cross-Site-Scripting (XSS)
Other news entries
- WordPress: Schwachstelle ermöglicht CodeausführungVulnerabilityBSI CERT-Bund
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressNewsSecurityWeek
- WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 HoursNewsThe Hacker News
- Fresh WordPress Vulnerability in Attackers’ CrosshairsNewsSecurityWeek
- WordPress: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- WordPress: Exploit-Versuche beobachtet, Update stopft Schadcode-LückeNewsheise Security
- Multiples vulnérabilités dans WordPress (29 octobre 2026)NewsCERT-FR (ANSSI)
- WordPress sites compromised after TeamUpdraft credential exposureNewsCSO Online
Source: https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html
ID