As cited
Copy frozen at (site build).
vulnerabilities
WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 was released on September 17, 2026, containing 11 security fixes and 17 bug fixes. The critical issue is an unauthenticated stored cross-site scripting (XSS) vulnerability in the wpautop() function (CVE-2026-93485, CVSS 3.1 score 7.1) that allows attackers to inject malicious scripts through comments without authentication. The vulnerability exploits a regex flaw in wpautop() that fails to account for quoted attribute values, enabling payload injection when comments are displayed and processed by content filters.
Why it matters: WordPress site administrators and developers must patch immediately, especially those accepting public comments; unauthenticated users can inject executable scripts visible to all visitors, and comment moderation does not reliably prevent exploitation since payloads appear unremarkable in the queue.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 was released on September 17, 2026, with 11 security fixes addressing multiple vulnerabilities across the platform. The most critical issue is CVE-2026-93485, an unauthenticated stored cross-site scripting (XSS) vulnerability in the wpautop() function that processes comments and can be exploited through ordinary comment forms by anonymous users. The vulnerability requires comment approval before the payload executes, and the update also patches ten additional flaws including access control issues, disclosure problems, and other XSS weaknesses.
Why it matters: WordPress site administrators and hosting providers should immediately update all instances to 7.1.1, as the unauthenticated stored XSS in comments poses risk to any site accepting public comments and moderators regularly approve comments that may contain malicious payloads.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 released on September 17, 2026, addressing 11 security issues including an unauthenticated stored cross-site scripting (XSS) vulnerability in the wpautop() function that processes line breaks. The flaw, assigned CVE-2026-93485 with a CVSS 3.1 score of 7.1, allows attackers to inject malicious scripts through comments on nearly all WordPress content. The vulnerability requires comment moderation to be bypassed but affects all unpatched WordPress versions through 7.1, with the fix available immediately in the latest release.
Why it matters: WordPress site administrators should prioritize updating to 7.1.1 immediately, especially those accepting public comments; any visitor to a site with an approved malicious comment can execute scripts in the site origin regardless of login status.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 arrived on September 17, 2026, with 11 security fixes and 17 bug fixes addressing an unauthenticated stored cross-site scripting (XSS) vulnerability in the wpautop() function that processes comments on nearly all WordPress content. CVE-2026-93485, with a CVSS 3.1 score of 7.1, stems from a regular expression flaw that fails to account for quoted attribute values, allowing an attacker to inject malicious code through an ordinary comment that bypasses sanitization and executes when displayed to any site visitor. The vulnerability requires comment moderation to pass the payload to the live site, and the release also includes ten additional fixes for access control, information disclosure, and other issues requiring authenticated access.
Why it matters: WordPress site administrators and hosting providers must prioritize updating to 7.1.1 immediately, particularly sites accepting public comments, as unauthenticated attackers can inject executable code visible to all visitors once a comment is approved.
- Source published
- First seen by Cybersecurity Tracker