WordPress Core Unauthenticated Stored XSS via Comments - CVE-2026-93485

Could your systems be exposed to this vulnerability?

WordPress core versions 4.7 through 7.1.0 (fixed in 7.1.1) are vulnerable to unauthenticated stored cross-site scripting via the comment submission endpoint. Comment moderation is disabled by default and the requirement for a previously approved comment can be bypassed, permitting unauthenticated attackers to inject persistent JavaScript (DOM-Based XSS). This template fingerprints the WordPress version via the RSS feed generator tag to identify affected installations without triggering the vulnerability.

Enter a domain or public IP you own. We'll check for signs of exposure. No signup required.