CVE-2026-93485 is a DOM-based cross-site scripting vulnerability in the Automattic WordPress core caused by improper input neutralization during web page generation. It affects a wide range of WordPress versions starting from 4.7 up to versions before 7.1.1. The vulnerability allows unauthenticated attackers to inject malicious scripts, leveraging the default configuration where comment moderation is disabled and the approval requirement for commenters can be bypassed. This issue can be reproduced on a default WordPress installation without additional configuration.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:L/I:L/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider enabling comment moderation and restricting comment approvals to mitigate the risk of exploitation. Monitor official WordPress security channels for updates and apply patches promptly once released.