WordPress Core

WordPress 7.1.1 fixes 11 security issues, including CVE-2026-93485 stored XSS and the Click2Shell crafted-URL chain. Update WordPress Core immediately.

WordPress 7.1.1 fixes 11 security issues, including unauthenticated stored cross-site scripting in wpautop() and a crafted-URL chain that could install and preview a vulnerable theme. WordPress recommends updating immediately. The stored XSS is tracked as CVE-2026-93485 with CVSS 7.1; the separate crafted-URL chain has been described as Click2Shell.

Table of Contents

Security release summary

Product	WordPress Core
Affected versions	WordPress 7.1 and earlier for the headline issues; security backports are being prepared for eligible branches
Fixed version	WordPress 7.1.1
Security fixes	11
Headline CVE	CVE-2026-93485, unauthenticated stored XSS in `wpautop()`
Click2Shell prerequisite	A logged-in administrator must load a crafted URL, or an existing XSS must trigger it in the administrator’s browser
Known exploitation	No in-the-wild exploitation was established by the sources reviewed for this post

CVE-2026-93485: unauthenticated stored XSS in wpautop()

Patchstack reports that an anonymous visitor can submit specially structured content through the normal comment form. The input can pass the comment allowlist because it does not initially look like executable markup. The danger appears later, when wpautop() transforms line breaks and block elements while rendering the approved comment.

The vulnerable regular expression did not correctly distinguish a tag-closing character from the same character inside a quoted attribute. A line-break placeholder inserted by WordPress could therefore create a parsing mismatch. Subsequent formatting could move attacker-controlled text into an HTML attribute context and produce script execution in the site’s origin.

The comment must be published before visitors are exposed. First-time commenters are normally held for moderation, but previously approved commenters may be auto-approved. Moderation reduces exposure; it is not a substitute for patching.

Click2Shell: crafted URL to conditional remote code execution

The Click2Shell chain starts in the WordPress theme-install flow. A theme slug from the URL was interpreted differently by the server-side Themes API and the browser-side JavaScript. The server sanitized the slug, while the raw value was inserted into a jQuery selector in wp-admin. A crafted value could make the interface act as though the administrator had selected a different theme for installation.

Installing an inactive theme alone does not normally execute its code. The demonstrated chain then opened the Customizer preview, which loads the inactive theme’s functions.php. Patchstack reports that the proof used Mobile Repair Zone 2.5.4, whose own insecure AJAX handler could download and execute an attacker-controlled plugin ZIP. That second vulnerable component turned the forced theme action into server-side code execution.

This is not a drive-by attack against ordinary visitors. The administrator must be logged in and load the crafted URL, or another vulnerability such as stored XSS must cause the request in the administrator’s browser. Full RCE also depends on a suitable vulnerable theme and the ability to install files.

WordPress 7.1.1 fixes the selector issue by restricting the target to real theme elements and escaping the slug with $.escapeSelector().

Other security fixes in WordPress 7.1.1

HTML API comment breakout through abrupt-closing sequences.
Stored XSS in some themes that support custom headers.
Network activation of an installed network-only plugin by a site administrator.
Authenticated path traversal in the REST Templates Controller.
XML-RPC publication of customize_changeset posts without the expected edit_css check.
Contributor-level arbitrary post overwrite.
Disclosure of a private parent post title.
Contributor-level disclosure of draft and pending post slugs.
Comment and note reparenting by authenticated users.

Immediate remediation

Update WordPress Core to 7.1.1 immediately. Sites remaining on an older maintained branch should install that branch’s security backport when available, but moving to the current supported release is preferred.
Confirm the version after the update and verify Core checksums.
Review recently approved comments, especially comments from newly created or unexpected accounts. Do not manually render suspicious markup in an administrator session.
Review newly installed themes and plugins, administrator activity, and file changes around any suspicious admin-session event.
Consider disabling dashboard file modifications on production sites where updates are performed through a controlled deployment process. This reduces the impact of installation chains but does not repair the vulnerability.

wp core update
wp core version
wp core verify-checksums

For controlled deployments, this hardening setting can prevent dashboard theme and plugin installation. Test your update workflow before enabling it:

define( 'DISALLOW_FILE_MODS', true );

Verification and incident checks

Use WP-CLI to inventory active and inactive themes and recently changed plugins:

wp theme list --fields=name,status,version,update --format=table
wp plugin list --fields=name,status,version,update --format=table
wp user list --role=administrator --fields=ID,user_login,user_registered --format=table

If an unknown theme or plugin appeared, preserve logs and a filesystem copy before removal. Treat unexpected executable files, unauthorized administrators, or unexplained outbound downloads as compromise indicators and follow a full incident-response process.

Sources

WPDeeply is summarizing disclosures by the WordPress Security Team, Patchstack, pwn.ai, and the credited researchers. This is not a claim of original discovery.