https://vulnerability.circl.lu/sightings/feed 2026-09-22T10:05:01.787074+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3e6978fa-20d3-4847-92fd-3731abb0ba1e/export 2026-09-22T10:05:01.807683+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "3e6978fa-20d3-4847-92fd-3731abb0ba1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html", "content": "A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server.\n\nWordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed \"Comment2Shell,\" on September 17 in version 7.1.1 and told site owners to update right away. There is", "creation_timestamp": "2026-09-22T10:00:44.192017Z"} 2026-09-22T10:00:44.192017+00:00 https://vulnerability.circl.lu/sighting/55c26fa2-3209-4151-bdd2-f4c01349b0bd/export 2026-09-22T10:05:01.810498+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "55c26fa2-3209-4151-bdd2-f4c01349b0bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/10118", "content": "\u203c\ufe0f WordPress \"Comment2Shell\" vulnerability (CVE-2026-93485) can turn an anonymous comment into server code execution through a logged-in admin session.\n\nThe chain starts as stored XSS, fires when the page loads, and can use the admin\u2019s session to upload a web shell.\n\nDetails \u2192 https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html", "creation_timestamp": "2026-09-22T09:00:04.503649Z"} 2026-09-22T09:00:04.503649+00:00 https://vulnerability.circl.lu/sighting/8c78742d-4e7f-45f9-987e-bac2da0e6d6d/export 2026-09-22T10:05:01.810639+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8c78742d-4e7f-45f9-987e-bac2da0e6d6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mvsrohbdm32m", "content": "WordPress 7.1.1 is out (maintenance + security).\n\n11 security fixes, including stored XSS in Core wpautop() from an ordinary comment (CVE-2026-93485).\n\nUpdate to 7.1.1 now. Auto-updates pick it up if enabled.\n\nwordpress.org/news/2026/09...\n\n#WordPress #WordPressSecurity", "creation_timestamp": "2026-09-18T18:17:14.451036Z"} 2026-09-18T18:17:14.451036+00:00 https://vulnerability.circl.lu/sighting/8c183186-ebcb-4427-a26c-121d29b0a35d/export 2026-09-22T10:05:01.810747+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8c183186-ebcb-4427-a26c-121d29b0a35d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvrkde3ufd2t", "content": "WordPress core has a stored cross-site scripting flaw (CVE-2026-93485) a blog comment can carry.\n\nIt hits every version back to 4.7 and fires when the comment is shown.\n\nUpdate to 7.1.1, then review pending comments.", "creation_timestamp": "2026-09-18T06:33:06.383161Z"} 2026-09-18T06:33:06.383161+00:00