7.2

CVE-2026-93485: automattic wordpress Cross-site Scripting

CVSS: 7.2v3.1HighDeferred
AliasesUBUNTU-CVE-2026-93485DEBIAN-CVE-2026-93485
Published 18-09-2026Last modified 17-10-2026
Open JSON

Vulnerability summary

CVE-2026-93485 is a high (CVSS 7.2) Cross-site Scripting vulnerability in automattic wordpress. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.5% of scored vulnerabilities. Fixed in 6.6.8.

Overall risk
29/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.2/10
010
High · v3.1 (wordfence)
EPSS score
0.35%
0%100%
Low · +0.19 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 18-09-2026
    PublishedVulnerability first disclosed.
  2. 17-10-2026
    Last modifiedVulnerability information updated.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

28%

Versus all other CVEs

30-day change

+0.19 pp

From 0.16% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Automattic1 product
  • wordpress7.1 | ≥ 7.0, ≤ 7.0.4 | ≥ 6.9, ≤ 6.9.7 | ≥ 6.8, ≤ 6.8.8 | ≥ 6.7, ≤ 6.7.7 | ≥ 6.6, ≤ 6.6.7 | ≥ 6.5, ≤ 6.5.10 | ≥ 6.4, ≤ 6.4.10 | ≥ 6.3, ≤ 6.3.10 | ≥ 6.2, ≤ 6.2.11 | ≥ 6.1, ≤ 6.1.12 | ≥ 6.0, ≤ 6.0.14 | ≥ 5.9, ≤ 5.9.16 | ≥ 5.8, ≤ 5.8.15 | ≥ 5.7, ≤ 5.7.17 | ≥ 5.6, ≤ 5.6.19 | ≥ 5.5, ≤ 5.5.20 | ≥ 5.4, ≤ 5.4.21 | ≥ 5.3, ≤ 5.3.23 | ≥ 5.2, ≤ 5.2.26 | ≥ 5.1, ≤ 5.1.24 | ≥ 5.0, ≤ 5.0.27 | ≥ 4.9, ≤ 4.9.31 | ≥ 4.8, ≤ 4.8.30 | ≥ 4.7, ≤ 4.7.35
Debian1 product
  • wordpressAll versions (No fix recorded) | < 6.8.10+dfsg1-0+deb13u1 | < 7.1.1+dfsg1-1
Ubuntu1 product
  • wordpressAll versions (No fix recorded)
Wordpress1 product
  • wordpress≤ 6.6.7 (fixed in 6.6.8) | ≥ 6.7, ≤ 6.7.7 (fixed in 6.6.8) | ≥ 6.8, ≤ 6.8.8 (fixed in 6.6.8) | ≥ 6.9, ≤ 6.9.7 (fixed in 6.6.8) | ≥ 7.0, ≤ 7.0.4 (fixed in 6.6.8) | 7.1 (fixed in 6.6.8)

4 vendors · 4 products

References

6 links