{"vulnerability": "cve-2026-9348", "sightings": [{"uuid": "8c183186-ebcb-4427-a26c-121d29b0a35d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvrkde3ufd2t", "content": "WordPress core has a stored cross-site scripting flaw (CVE-2026-93485) a blog comment can carry.\n\nIt hits every version back to 4.7 and fires when the comment is shown.\n\nUpdate to 7.1.1, then review pending comments.", "creation_timestamp": "2026-09-18T06:33:06.383161Z"}, {"uuid": "b8c747e6-a16d-4808-a624-03550f1da90c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93488", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvsdjzan742k", "content": "\ud83d\udfe0 CVE-2026-93488 - High (7.5)\n\nA flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-in...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93488/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-18T14:04:14.417895Z"}, {"uuid": "8c78742d-4e7f-45f9-987e-bac2da0e6d6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mvsrohbdm32m", "content": "WordPress 7.1.1 is out (maintenance + security).\n\n11 security fixes, including stored XSS in Core wpautop() from an ordinary comment (CVE-2026-93485).\n\nUpdate to 7.1.1 now. Auto-updates pick it up if enabled.\n\nwordpress.org/news/2026/09...\n\n#WordPress #WordPressSecurity", "creation_timestamp": "2026-09-18T18:17:14.451036Z"}, {"uuid": "55c26fa2-3209-4151-bdd2-f4c01349b0bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/10118", "content": "\u203c\ufe0f WordPress \"Comment2Shell\" vulnerability (CVE-2026-93485) can turn an anonymous comment into server code execution through a logged-in admin session.\n\nThe chain starts as stored XSS, fires when the page loads, and can use the admin\u2019s session to upload a web shell.\n\nDetails \u2192 https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html", "creation_timestamp": "2026-09-22T09:00:04.503649Z"}, {"uuid": "3e6978fa-20d3-4847-92fd-3731abb0ba1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html", "content": "A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server.\n\nWordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed \"Comment2Shell,\" on September 17 in version 7.1.1 and told site owners to update right away. There is", "creation_timestamp": "2026-09-22T10:00:44.192017Z"}, {"uuid": "a6519164-d1ec-4bea-9384-7498c47ad1a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mw432dx5mc2c", "content": "Comment2Shell (CVE-2026-93485) lets an anonymous WordPress comment reach RCE via an admin session. Fixed in 7.1.1 \u2014 update now.\nwww.cyberkendra.com/2026/09/comm...\n\n#wordpress #security #comment2shell", "creation_timestamp": "2026-09-22T10:58:59.399230Z"}, {"uuid": "0ac61179-36ec-4fbf-b7f3-d33d9396a7d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mw4ec4fzes2w", "content": "WordPress 7.1.1 (17 Sep) patched Click2Shell and Comment2Shell (CVE-2026-93485). Public PoCs and mainstream write-ups landed 21\u201322 Sep.\n\nAgency checklist:\n1) Confirm every install is on 7.1.1 or your branch\u2019s security backport\n2) Check inactive themes you did not expect\n3) Tighten comment moderation", "creation_timestamp": "2026-09-22T13:44:18.601425Z"}, {"uuid": "d7705796-efbb-44e9-a45e-31fbc13d1607", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://www.acn.gov.it/portale/w/wordpress-poc-pubbliche-per-lo-sfruttamento-di-nuove-vulnerabilita", "content": "", "creation_timestamp": "2026-09-23T12:45:04.315478Z"}, {"uuid": "92efcbbd-c077-44a9-9b98-a139fbbf98e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mw6sbfwjnj2e", "content": "Details and PoC exploit code for a critical WordPress stored XSS are public. Learn how CVE-2026-93485 enables RCE and patch WordPress today.\n\n#WordPress #CVE202693485 #StoredXSS #RCE #Cybersecurity #Infosec", "creation_timestamp": "2026-09-23T12:59:47.124439Z"}, {"uuid": "a9913553-fce2-4f7c-a8b4-f04a7a20741c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwabtjfxef2w", "content": "WordPress Stored XSS PoC Released for CVE-2026-93485\uff08WordPress\u306e\u8a8d\u8a3c\u4e0d\u8981Stored XSS\u3001PoC\u516c\u958b\u3067RCE\u306b\u3064\u306a\u304c\u308b\u6050\u308c\uff09 #SecurityOnline (Sep 24)\n\nsecurityonline.info/wordpress-st...", "creation_timestamp": "2026-09-24T03:11:00.481020Z"}, {"uuid": "241fdf9b-7594-43d6-9bcc-c91bb565f755", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://t.me/pphm_HackerNews/3250", "content": "\ud83d\udd34 WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session\n\nA new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server.\n\nWordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed \"Comment2Shell,\" on September 17 in version 7.1.1 and told site owners to update right away. There is no sign it has been used in attacks, and it is not on the U.S. government's list of actively exploited software flaws.", "creation_timestamp": "2026-09-22T15:26:01.000000Z"}, {"uuid": "5329024e-e5c9-42e6-b2e3-5bd30fdc09d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://t.me/CyberDispatch/3034", "content": "WordPress \"Comment2Shell\" vulnerability (CVE-2026-93485) can turn an anonymous comment into server code execution through a logged-in admin session.\n\nThe chain starts as stored XSS, fires when the page loads, and can use the admin\u2019s session to upload a web shell.", "creation_timestamp": "2026-09-22T06:44:44.000000Z"}, {"uuid": "e47f7bdb-89ca-4330-b5a9-89c22e123fd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://t.me/GithubRedTeam/103291", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Comment2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a DeathShotXD\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 02:16:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nComment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T03:00:08.000000Z"}, {"uuid": "907c1d8a-382d-465f-a870-8166068337ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103291", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Comment2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a DeathShotXD\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 02:16:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nComment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T03:00:08.000000Z"}, {"uuid": "27c88ed9-304d-427b-84fa-f812b54e92ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "Telegram/EmRZAGamCJR2U6gUa4LqCH7O9lyIXxV2yYE95jSxyXrbXQ", "content": "", "creation_timestamp": "2026-09-22T08:17:37.000000Z"}, {"uuid": "c3304c06-7652-44eb-b448-24ed235a75e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "Telegram/baeiM9fRMd5lQ2ZvmOQ70_pifu-s1kWTpwT4Ot-GKiqZMMo", "content": "", "creation_timestamp": "2026-09-23T03:00:06.000000Z"}, {"uuid": "5cd3d035-34bb-480f-8f43-853770b369fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "Telegram/Wgq1BNTsNQk_rBC9PIREH3MUaB-wRqcK6z3rgKCH7ZVQxRE", "content": "", "creation_timestamp": "2026-09-22T21:00:04.000000Z"}, {"uuid": "7ad35428-3220-4d14-a9b8-7a5cf0b67d64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "published-proof-of-concept", "source": "Telegram/EmRZAGamCJR2U6gUa4LqCH7O9lyIXxV2yYE95jSxyXrbXQ", "content": "", "creation_timestamp": "2026-09-22T08:17:37.000000Z"}, {"uuid": "86835064-4ff5-4d28-9f3d-3972b89fda3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://t.me/true_secator/8636", "content": "\u0415\u0449\u0435 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, Comment2Shell (CVE-2026-93485), \u0432 WordPress \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0432 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 (RCE) \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0441\u0441\u0438\u044e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u0422\u0430\u043a \u0447\u0442\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0441\u043a\u0440\u0438\u043f\u0442 \u043d\u0430 \u0441\u0430\u0439\u0442 WordPress, \u0438 \u0435\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u0437\u0436\u0435 \u043e\u0442\u043a\u0440\u043e\u0435\u0442 \u044d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442, \u043e\u043d \u0441\u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\nComment2Shell \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0420\u0430\u0444\u0438 \u041c\u0443\u0445\u0430\u043c\u043c\u0430\u0434\u043e\u043c \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 WordPress 7.1.1 17 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2026 \u0433\u043e\u0434\u0430.\n\nCVE-2026-93485 \u0438\u043c\u0435\u0435\u0442 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 7.1 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS 3.1 \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e XSS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 wpautop() \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u0443\u0435\u0442 \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u044b \u0441\u0442\u0440\u043e\u043a \u0432 \u0430\u0431\u0437\u0430\u0446\u044b \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u043e \u0432\u0441\u0435\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u0445, \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u044b\u0445 WordPress. \n\nWordPress \u043e\u0447\u0438\u0449\u0430\u0435\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u043f\u0440\u0438 \u0435\u0433\u043e \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0438 \u043f\u0435\u0440\u0435\u0444\u043e\u0440\u043c\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0435\u0433\u043e \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b, \u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043a\u0435 \u043c\u0435\u0436\u0434\u0443 \u044d\u0442\u0438\u043c\u0438 \u0434\u0432\u0443\u043c\u044f \u0448\u0430\u0433\u0430\u043c\u0438. \u0412 \u0437\u0430\u043f\u0438\u0441\u0438 CVE \u043e\u043d\u0430 \u0443\u043a\u0430\u0437\u0430\u043d\u0430 \u043a\u0430\u043a XSS \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 DOM, \u0445\u043e\u0442\u044f WordPress \u0438 Patchstack \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0435\u0451 \u043a\u0430\u043a \u0445\u0440\u0430\u043d\u0438\u043c\u0443\u044e XSS.\n\n\u041f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044c \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0441\u0438\u043c\u0432\u043e\u043b blockquote \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u0432 cite \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0435. \u042d\u0442\u043e\u0442 \u0432\u0432\u043e\u0434 \u043e\u0447\u0438\u0449\u0430\u0435\u0442 wp_kses() \u0444\u0438\u043b\u044c\u0442\u0440 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 WordPress, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432 \u043d\u0451\u043c \u043d\u0435\u0442 \u043d\u0438\u0447\u0435\u0433\u043e \u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e.\n\n\u041a\u043e\u0433\u0434\u0430 \u043f\u043e\u0441\u0442 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442\u0441\u044f, \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0444\u043e\u0440\u043c\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u0442 \u0440\u0430\u0437\u043c\u0435\u0442\u043a\u0443, \u043e\u0448\u0438\u0431\u043e\u0447\u043d\u043e\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0432\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0433 \u0430\u0431\u0437\u0430\u0446\u0430 \u0432\u043d\u0443\u0442\u0440\u044c \u0446\u0438\u0442\u0430\u0442\u044b, \u0438 \u043d\u0435\u043a\u043e\u0433\u0434\u0430 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u044b\u0439 \u0442\u0435\u043a\u0441\u0442 \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c onfocus \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043a\u0440\u0438\u043f\u0442\u0430 autofocus.\n\n\u0421\u043a\u0440\u0438\u043f\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432 \u043c\u043e\u043c\u0435\u043d\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b - \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0449\u0435\u043b\u0447\u043a\u0430 \u043c\u044b\u0448\u044c\u044e. \u0412 \u0441\u0435\u0441\u0441\u0438\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0432\u043e\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443, \u043e\u043d \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 nonce \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0430 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 PHP-\u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u044f XSS \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430.\n\n\u0412\u0441\u0435 \u0432\u0435\u0442\u043a\u0438, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 4.7, \u0443\u044f\u0437\u0432\u0438\u043c\u044b, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0438\u0436\u0435 \u0443\u0440\u043e\u0432\u043d\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0431\u043e\u0440\u043a\u0438. WordPress \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u0432\u0435\u0440\u0441\u0438\u044e 4.7.36.\n\n\u041f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e, \u0438 \u043f\u043e\u043a\u0430 \u043e\u0448\u0438\u0431\u043a\u0430 \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CISA, \u043d\u043e \u0432\u0441\u0435 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u0441\u0442\u0440\u043e \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c\u0441\u044f.", "creation_timestamp": "2026-09-22T17:30:06.000000Z"}, {"uuid": "0cfb1b42-3fdf-4a05-a1c8-ec955847ef84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://bsky.app/profile/tccubed.com/post/3mwe5dxjndn2n", "content": "WordPress Under Active Attack, Google Ads Scam Locks Browsers, and CISA Flags Exploited Flaws\n\nWordPress sites are under active attack through CVE-2026-93485, a critical vulnerability in WordPress Core versions 4.7. 0 through 7.1.\n\nhttps://youtu.be/aIwJMtSJ2m8", "creation_timestamp": "2026-09-25T16:01:23.238403Z"}, {"uuid": "30c77d64-4d70-4f3a-81ff-b6cbcd3300a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "published-proof-of-concept", "source": "Telegram/baeiM9fRMd5lQ2ZvmOQ70_pifu-s1kWTpwT4Ot-GKiqZMMo", "content": "", "creation_timestamp": "2026-09-23T03:00:06.000000Z"}, {"uuid": "1bf02ca0-fadf-4cd4-bc34-dce1f6c7b40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://t.me/GithubRedTeam/103431", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-WP-CORE-CVE-2026-93485\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 686f6c61\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 12:55:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLaboratorio pedag\u00f3gico de CVE-2026-93485 (Comment2Shell): stored XSS no autenticado en WordPress core v\u00eda wpautop -> RCE, con demo del root cause auto-verificada, control 7.1.1 y la v\u00eda Post2Shell\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T13:00:08.000000Z"}, {"uuid": "bbfef3ba-3f7f-4bac-99aa-83297f4799f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103431", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-WP-CORE-CVE-2026-93485\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 686f6c61\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 12:55:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLaboratorio pedag\u00f3gico de CVE-2026-93485 (Comment2Shell): stored XSS no autenticado en WordPress core v\u00eda wpautop -> RCE, con demo del root cause auto-verificada, control 7.1.1 y la v\u00eda Post2Shell\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T13:00:08.000000Z"}, {"uuid": "813abcde-f04c-4ddc-a92a-5733b80d9ac4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "Telegram/aouElhUq9Ye3BGvbzz59jTMPBnYDztZUvud3qnXOw9ieT70", "content": "", "creation_timestamp": "2026-09-26T21:00:05.000000Z"}, {"uuid": "4ff4e193-003b-42b1-a83c-b76e302f3346", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "Telegram/1icfDYPfcqBNy4oZYvRCCHditTCoxypxb2kpqptiMANqlNw", "content": "", "creation_timestamp": "2026-09-26T15:00:22.000000Z"}, {"uuid": "3a7656c7-63dc-4712-be35-c7adc4efe0e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "published-proof-of-concept", "source": "Telegram/aouElhUq9Ye3BGvbzz59jTMPBnYDztZUvud3qnXOw9ieT70", "content": "", "creation_timestamp": "2026-09-26T21:00:05.000000Z"}, {"uuid": "fabf16c5-710a-4287-a68b-5ebd501a82a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "published-proof-of-concept", "source": "Telegram/1icfDYPfcqBNy4oZYvRCCHditTCoxypxb2kpqptiMANqlNw", "content": "", "creation_timestamp": "2026-09-26T15:00:22.000000Z"}, {"uuid": "fe46a3e4-ec92-4718-a7e3-bc6c2c89f09e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117354629933360092", "content": "Comment2Shell - CVE-2026-93485 Exploit PoC#CVE_2026_93485 #WordPress https://github.com/DeathShotXD/Comment2Shell", "creation_timestamp": "2026-09-29T13:45:44.053780Z"}, {"uuid": "8b761260-a813-4296-89d5-61a095bb936e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://gist.github.com/mifzal/d9fd47a41c5747434f037a4c235d1758", "content": "#!/usr/bin/env bash\n# University of Washington CVE-2026-93485 disclosure \u2014 passive-only evidence playback\n# LIVE=1 bash UW_Engagement_Playback.sh \u2192 re-run passive fingerprinting (GET only)\ncd /mnt/d/bantai1/comment2shell || exit 1\nLIVE=${LIVE:-0}\nHOSTS=\"www.radonc.washington.edu radonc.washington.edu www.radiationoncology.washington.edu radiationoncology.washington.edu www.uwcc.washington.edu\"\nTARGET=\"radiationoncology.uw.edu\"\nbanner(){ echo; echo \"\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\"; echo \"  $1\"; echo \"\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\"; }\n\nbanner \"EVIDENCE 1/4 \u2014 PASSIVE DETECTION: WordPress 7.1.0 on $TARGET\"\necho \"All legacy hostnames redirect to this single instance:\"\nfor h in $HOSTS; do\n  printf \"  %-45s -> %s\\n\" \"$h\" \"$(curl -skL -o /dev/null -w '%{url_effective}' -A 'Mozilla/5.0' \"https://$h/\" 2>/dev/null)\"\ndone\necho; echo \"Generator meta (from $TARGET):\"\nif [ \"$LIVE\" = 1 ]; then\n  curl -skL -m 15 -A 'Mozilla/5.0' \"https://$TARGET/\" | grep -oiE ']*>' | head -1\nelse\n  d=$(ls -d disclosure/uw/radonc.washington.edu_* 2>/dev/null | sort | tail -1)\n  head -1 \"$d/generator.txt\" 2>/dev/null || echo \"(absent)\"\nfi\n\nbanner \"EVIDENCE 2/4 \u2014 THREE INDEPENDENT WITNESSES (gen/feed/verparams)\"\nd=$(ls -d disclosure/uw/radonc.washington.edu_* 2>/dev/null | sort | tail -1)\necho \"From $TARGET (captured via radonc.washington.edu):\"\necho \"  gen  : $(head -1 $d/generator.txt 2>/dev/null || echo '(absent)')\"\necho \"  feed : $(head -1 $d/feed_gen.txt 2>/dev/null || echo '(absent)')\"\necho \"  ver  :\"\ngrep -h 'ver=7.1' $d/verparams.txt 2>/dev/null | head -2 | sed 's/^/         /'\n\nbanner \"EVIDENCE 3/4 \u2014 INTEGRITY: SHA-256 VERIFICATION\"\necho \"\u2500\u2500 radonc.washington.edu (representative capture)\"\nd=$(ls -d disclosure/uw/radonc.washington.edu_* 2>/dev/null | sort | tail -1)\n( cd \"$d\" && sha256sum -c hashes.sha256 ) 2>/dev/null || echo \"(hash file not found)\"\necho; echo \"Hash consistency check (all legacy hostnames serve identical content):\"\nsha256sum disclosure/uw/*_20260930T004410Z/home.html 2>/dev/null | awk '{print \"  \" $1 \"  \" $2}'\n\nbanner \"EVIDENCE 4/4 \u2014 VERDICT: 1 INSTANCE / 5 LEGACY HOSTNAMES = LIKELY VULNERABLE\"\nprintf \"%-35s %-8s %s\\n\" \"INSTANCE\" \"VERSION\" \"STATUS\"\nprintf \"%-35s %-8s %s\\n\" \"$TARGET\" \"7.1.0\" \"LIKELY VULNERABLE (CVE-2026-93485)\"\necho; echo \"Accessible via legacy hostnames:\"\nfor h in $HOSTS; do printf \"  %s\\n\" \"$h\"; done\necho; echo \"Methodology: Passive fingerprinting only (public GET, redirects followed). No exploitation.\"\necho \"Reproduction: Isolated Docker laboratory (wordpress:7.1.0 image).\"\necho \"Safe Harbor: Consistent with CFAA safe harbor principles and UW CISO reporting guidance.\"\n", "creation_timestamp": "2026-09-30T02:22:27.000000Z"}]}