WordPress 7.1.1 Patches an Unauthenticated Comment XSS as AI Firms Keep Finding Its Bugs

WordPress 7.1.1 shipped on September 17, closing eleven security holes in Core alongside seventeen general Core bug fixes and nineteen Block Editor fixes. The most reachable of the eleven needs no WordPress account at all: an unauthenticated stored cross-site scripting (XSS) bug in wpautop(), the function that turns line breaks into paragraphs on nearly every piece of content WordPress renders, reachable through an ordinary blog comment. It is also the third straight WordPress Core security release in a row where the project’s own reporter credits name an AI company, a pattern the security team has started building a formal response around.

How an ordinary comment becomes a script

The headline bug, tracked as CVE-2026-93485 and rated 7.1 (High) on the CVSS 3.1 scale, was reported to Patchstack’s Vulnerability Disclosure Program on September 15 by Rafie Muhammad of Awesome Motive, the company behind several of WordPress’s most-installed plugins, including WPForms, MonsterInsights, and All in One SEO. WordPress’s own security team credits him by name in its 7.1.1 release announcement.

wpautop(), which lives in wp-includes/formatting.php, is one of the few content filters in WordPress Core that works on raw text with regular expressions instead of parsing markup into a structured tree. One of those expressions handles a narrow case: when a <blockquote> element is wrapped in a stray <p> tag, the function moves the <p> back inside it. To do that, the pattern grabs everything between <blockquote and the first > character it meets, on the assumption that the first > is always the tag’s real closing bracket. That assumption fails the moment a > turns up earlier, inside a quoted attribute value.

WordPress supplies that character itself. A separate part of wpautop() protects line breaks sitting inside HTML tags by swapping them for a placeholder, an HTML comment reading <!-- wpnl -->. Because an HTML comment closes with -->, a plain line break placed inside a quoted attribute value turns into a literal > sitting inside that attribute. WordPress’s comment allowlist happens to permit the tag <blockquote cite="">, and nothing in wp_kses(), the function that sanitizes comment markup at submission time, has any reason to strip a newline out of a cite value: a newline is entirely legitimate input. It is only later, every time the comment is displayed, that wpautop() turns it into an unintended closing bracket, splits the tag in the wrong place, and lets attacker-supplied text land in the part of the markup where a tag’s own attributes go instead of safely inside a quoted string. Patchstack describes the outcome as script execution in the site’s own origin for any visitor who loads the page, logged in or not. The fix in 7.1.1 makes the same regular expression aware of quoting, so a > inside a quoted value no longer reads as the end of a tag.

What actually limits it

One thing keeps this from being a pure drive-by: on a default WordPress install, a first-time commenter’s post has to clear moderation before wpautop() ever renders it, since WordPress holds unfamiliar commenters in a queue until a person approves them. Patchstack is blunt about how much protection that buys in practice. The payload does not look like markup at submission time, so there is nothing obviously suspicious for a moderator to catch, approving comments is routine and unremarkable work, and once a commenter has had one comment approved, WordPress auto-approves everything else that commenter submits afterward by default. Patchstack’s advisory singles this out as the release’s priority fix for any site that accepts public comments, especially where moderation is delegated to someone other than the site owner or where returning commenters are set to auto-approve.

Ten more fixes, two of them Anthropic’s

The other ten security fixes in 7.1.1 mostly require some level of account access, and two of the ten came from an unusual reporter. WordPress’s release notes credit Anthropic with finding an authenticated path traversal bug in the WP REST Templates Controller and a separate Contributor-level bug that let a low-privilege account overwrite arbitrary posts. Researcher Paulos Yibelo and the firm pwn.ai are credited with a specially crafted URL that could automatically install and preview an inactive theme pulled straight from WordPress.org.

The rest, per the official credits: a Multisite bug that let a site administrator network-activate a plugin marked network-only (Jesse McNeil); a stored XSS affecting themes that support custom header images, and a separate HTML API bug letting modified text break out of a comment (both found by WordPress Security Team member Jeremy Felt); an XML-RPC path that could publish customize_changeset posts without the normal edit_css permission check (Ben Bidner); a missing read_post permission check that could leak a private post’s title (HDWSec); disclosure of draft and pending post slugs to Contributor-level accounts (hermanhms); and a bug letting any logged-in user reparent comments, including notes (viridis).

A third straight AI-credited release

7.1.1 is the third consecutive WordPress Core security release in a row to carry an official reporter credit naming an AI company. WordPress 7.0.3, released August 6, credited both Anthropic (an Author-level CSS injection bug that bypassed WordPress’s own safe CSS attribute filter) and Aikido Security (a Multisite privilege escalation letting a user create a new site), alongside a pre-auth login-screen XSS from pwn.ai. WordPress 7.0.4, a week later, patched an Author-level remote code execution bug in how Imagick and Ghostscript handle certain PostScript content, also reported by pwn.ai. Both releases followed a more severe event in mid-July: WordPress 7.0.2, an out-of-cycle emergency release that force-pushed a fix through WordPress’s own auto-update system for a pre-authentication remote code execution chain, nicknamed wp2shell, that combined SQL injection with a REST API route-confusion bug and needed no login, no plugins, and no special configuration to exploit on a stock install.

WordPress’s security team has been openly grappling with the volume behind this run of releases. In an August 28 post on the project’s Make WordPress security blog, contributor Rudy Faile wrote that the project had seen “a substantial increase in the volume of incoming security reports” over the preceding year, attributing much of the growth to “the rapid advancement of frontier AI models and their growing capability to assist with security research.” The team’s response, which it calls the Core Security Initiative, is organized around three goals: a tighter, more automated release process with better end-to-end testing; putting more people on the backlog of open reports “with the aim of driving open findings down to zero”; and, notably, “applying AI-assisted scanning and tooling to find vulnerabilities before they can be exploited, complementing the reports received through responsible disclosure.” Trade coverage of the initiative, citing WordPress’s own HackerOne submission data, put a number on the shift: monthly reports climbing from a baseline that held at 20 to 30 a month for a decade to roughly 450 in July and 773 in August.

The shift is not unique to WordPress. sxz.io covered Docker joining a similar cross-industry effort in June, after Docker warned that frontier AI models are making it easier to read code, reason across dependencies, and surface chained flaws at machine speed across the wider open source ecosystem, not just inside any one project.

Update now

WordPress 7.1.1 is available now from the Dashboard under Updates, or as a direct download from WordPress.org; sites with automatic background updates enabled should already have it. The security fixes are being backported to every branch still eligible to receive them, a list that currently reaches back to version 4.7, though only the current release gets any ongoing support going forward. WordPress 7.1.1 is a short-cycle release; the next scheduled version, 7.2, is planned for December.

Featured image: a wall-mounted suggestion box in Sri Lanka, by Hashir Milhan, CC BY 2.0 via Wikimedia Commons; cropped and converted to WebP.