WordPress 7.1.1 fixes unauthenticated stored XSS
WordPress 7.1.1 arrived on 17 September 2026 with 11 security fixes and 17 Core bug fixes, led by an unauthenticated stored cross-site scripting flaw in wpautop(). Cross-site scripting, or XSS, means an attacker can make a site run unwanted script in a visitor’s browser. Stored XSS is more serious than a one-off link because the malicious content is saved on the site and can run later for other visitors.
Patchstack says the main flaw affects WordPress Core up to and including 7.1 and has been assigned CVE-2026-93485. It carries a CVSS 3.1 score of 7.1 with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. CVSS, the Common Vulnerability Scoring System, is a standard way to describe severity and attack conditions. In plain terms, this issue can be reached over the network, does not require an account, but does require a user interaction such as someone viewing the affected page.
The important detail for site owners is the entry point. Patchstack describes a payload placed into an ordinary public comment through the normal comment form by an anonymous visitor. It passes wp_kses(), the WordPress comment sanitiser that removes disallowed markup, because the submitted content does not initially look like the kind of HTML the filter is designed to strip. The danger appears later, when WordPress displays the comment and its display filters reshape the markup.
The vulnerable function is wpautop(), located in wp-includes/formatting.php. This Core filter turns line breaks into paragraphs across much of the content WordPress renders. Patchstack notes that wpautop() works with text and regular expressions rather than parsing HTML as a browser would. One expression that moved paragraph tags around blockquotes was not aware of quoted attribute values. It treated the first greater-than character it met as the end of a tag, even when that character appeared inside a quoted attribute value.
Patchstack’s explanation is subtle but important. An attacker did not need to supply that greater-than character directly. Earlier in wpautop(), WordPress protects newlines inside tags by replacing them with a placeholder. That placeholder is an HTML comment, and an HTML comment ends with a sequence that includes a greater-than character. WordPress’s comment allowlist permits a blockquote with a cite attribute, and a newline inside that cite value is not something wp_kses() would normally remove. The display process therefore supplies the character that later helps break the tag structure.
Once that happens, the tag can be split in the wrong place, the real closing quote of the attribute is left out of position, and later display filters complete the transformation. Patchstack says attacker-controlled text can end up where attributes belong rather than safely inside an attribute value. The outcome is script execution in the site’s own origin for any visitor who loads the page, whether that visitor is logged in or not. Patchstack did not publish a working payload or the full breakout chain.
The fix in WordPress 7.1.1 changes the relevant expression so it understands quoted values. That means a greater-than character inside a quoted attribute is no longer treated as the end of the tag. Patchstack says its customers are protected for this stored XSS issue, while still recommending that sites update to the most recent available WordPress version.
There is one practical limit on exploitation: the comment has to be published. On a stock WordPress install, comment_previously_approved holds a first-time commenter for moderation, meaning the payload waits in the queue until someone approves it. But moderation is not a security boundary. Approving comments is a routine task, the malicious comment can look ordinary in the moderation queue, and commenters who have previously been approved are auto-approved after that. Sites with public comments should treat this as the priority fix in the release, especially where moderation is delegated or returning commenters are allowed through automatically.
Patchstack’s timeline says the issue was reported to the Patchstack Vulnerability Disclosure Program on 15 September 2026, validated, and confirmed as communicated to the WordPress team. WordPress 7.1.1 was released on 17 September 2026 with the fix and backports to older supported branches. The timeline also includes an 18 September 2026 entry describing the same release and backports, and says the vulnerability was published to the Patchstack vulnerability database on 18 September 2026.
The rest of the security release is also relevant, although most of the other ten fixes require an account with some level of privilege. Contributor-level access was enough for an arbitrary post overwrite and for path traversal in the REST API templates controller. A REST API is a web interface that software can use to request or change data. Contributor-level access was also enough for disclosure of draft and pending post slugs, the short URL-friendly names used in post addresses.
Other fixes covered an issue where any authenticated user could reparent comments, including notes, and an Author-level XML-RPC issue that allowed publishing changeset posts while skipping the custom CSS capability check. XML-RPC is an older remote-control interface that lets software talk to WordPress. The release also fixed stored XSS in custom header images on some themes, an HTML API issue that allowed modified text to escape an HTML comment, and a crafted URL that could install and preview a theme from WordPress.org.
Multisite installations were also affected by one fix. Multisite is a WordPress mode where one installation can run multiple sites. WordPress 7.1.1 closes an issue where a site administrator could network-activate a network-only plugin. Another information disclosure issue exposed the title of a private parent post.
WordPress 7.1.1 is available through Dashboard, Updates, or directly from WordPress.org. Sites with automatic background updates enabled should receive it automatically. WordPress backported the fixes to older branches as far back as 4.7, and the release notes describe which branch received which fix. Patchstack notes, however, that only the most recent WordPress version is actively supported, and that is the version sites should be running.
For owners who do not want to manage WordPress security alone, AEU Hosting is managed WordPress hosting, secured end to end, which is directly relevant to keeping a business site on a safer footing. Whether a site is managed internally or by a provider, the immediate action is the same: update WordPress, check comment settings, and make sure public comment moderation is not treated as the only defence.