CVE-2026-93485

CVSS

—

EPSS

0.003 (17.9th percentile)

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

Unknown

Coverage

• 

  The Hacker News22 Sept, 06:03

  WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

  A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and called "Comment2Shell," on…

  ↗thehackernews.com/2026/09/wordpress-comment2she…(opens the publisher's site in a new tab)

What we observed