Filtered by tag: xss × Clear
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Matched: WordPress
A WordPress flaw dubbed "Comment2Shell" (CVE-2026-93485) allowed anonymous users to embed malicious scripts in comments. When an admin viewed the page, the script executed server-side code, turning a stored XSS into remote code execution. WordPress patched the issue in version 7.1.1 on September 17 and urged site owners to update immediately.
Vulnerability & Patch Roundup — April 2026
Matched: WordPress
Sucuri's April 2026 roundup highlights notable WordPress ecosystem vulnerabilities and available patches. Automated attacks exploiting known software flaws remain a leading cause of website compromises. The report aims to inform website owners of potential threats, with listed vulnerabilities already virtually patched for existing Sucuri Firewall customers.
Vulnerability & Patch Roundup — March 2026
Matched: WordPress
Sucuri's March 2026 vulnerability roundup highlights security patches and disclosures across the WordPress ecosystem. Automated attacks exploiting known vulnerabilities remain a top cause of website compromises. The listed vulnerabilities have been virtually patched via the Sucuri Firewall, protecting existing clients. The roundup aims to help website owners stay informed about potential threats to their environments.