TechNews

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

T2Covered by 1 source · first reported by The Hacker News at

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and called "Comment2Shell," on…

security

Sources

Vulnerabilities

Why this score
Signals contributing to the severity score
SignalPoints
widely deployed15