Filtered by category: Hacker News, tag: xss × Clear
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Matched: WordPress
A WordPress flaw dubbed "Comment2Shell" (CVE-2026-93485) allowed anonymous users to embed malicious scripts in comments. When an admin viewed the page, the script executed server-side code, turning a stored XSS into remote code execution. WordPress patched the issue in version 7.1.1 on September 17 and urged site owners to update immediately.