Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-93485

WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Automattic WordPress

Default version status: unaffected

  • 7.1affected
  • 7.0 to ≤ 7.0.4affected
  • 6.9 to ≤ 6.9.7affected
  • 6.8 to ≤ 6.8.8affected
  • 6.7 to ≤ 6.7.7affected
  • 6.6 to ≤ 6.6.7affected
  • 6.5 to ≤ 6.5.10affected
  • 6.4 to ≤ 6.4.10affected
  • 6.3 to ≤ 6.3.10affected
  • 6.2 to ≤ 6.2.11affected
  • 6.1 to ≤ 6.1.12affected
  • 6.0 to ≤ 6.0.14affected
  • 5.9 to ≤ 5.9.16affected
  • 5.8 to ≤ 5.8.15affected
  • 5.7 to ≤ 5.7.17affected
  • 5.6 to ≤ 5.6.19affected
  • 5.5 to ≤ 5.5.20affected
  • 5.4 to ≤ 5.4.21affected
  • 5.3 to ≤ 5.3.23affected
  • 5.2 to ≤ 5.2.26affected
  • 5.1 to ≤ 5.1.24affected
  • 5.0 to ≤ 5.0.27affected
  • 4.9 to ≤ 4.9.31affected
  • 4.8 to ≤ 4.8.30affected
  • 4.7 to ≤ 4.7.35affected

References