WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
1. Executive summary WordPress core versions 4.7 through 7.1 contain a stored cross-site scripting flaw, CVE-2026-93485 ("Comment2Shell"), rated 7.
22 Sep 2026 · 5 min read
read →