22 September 2026
Reference: CVE-2026-93485
1. What is being reported?
The issue is a type of security weakness called cross-site scripting (XSS) in WordPress core software. It affects many versions of WordPress up to 7.1. Older and current versions are vulnerable. Attackers can post malicious comments that run harmful code in the website administrator’s browser, which can lead to full control of the website.
2. What this means in plain English
If your website runs on a vulnerable WordPress version, attackers could exploit this flaw to take over your site. This could lead to your website being defaced, used to spread malware, or steal sensitive information. Even if you do not allow comments or moderate them, attackers may bypass these controls to exploit the flaw.
3. Could this affect a small business?
Small businesses, charities, clubs, or any organisation using WordPress versions listed as vulnerable could be affected. If you do not use WordPress or have updated beyond version 7.1.1, you are likely not affected. However, many small organisations may not be aware of their WordPress version or update status.
4. What to do now
- Check which version of WordPress your website is running.
- If your WordPress version is vulnerable, update it immediately to the latest secure version.
- Ensure comment moderation is enabled and consider disabling comments if not needed.
- Ask your IT provider to review your website security and monitor for unusual activity.
5. Ask your IT provider
Can you confirm if our WordPress website is affected by CVE-2026-93485 and ensure it is updated to a safe version?
6. Bottom line
Keep your WordPress website updated to protect against this serious vulnerability that could let attackers take control through website comments.
Information based on NVD, CISA KEV, and reputable security news reporting.