WordPress 7.1.1 Maintenance and Security Release
ResearchWordPressOur summary
WordPress 7.1.1 addresses 11 security vulnerabilities and 17 Core bugs, including CVE-2026-93485, an unauthenticated stored XSS flaw in the wpautop() content-formatting function affecting WordPress Core through 7.1. An anonymous visitor could submit a crafted comment that becomes executable script when the comment is published and viewed, potentially affecting any site visitor. WordPress has also backported fixes to supported older branches, but site operators should update to WordPress 7.1.1 or the latest available release.
Below is the opening; the full story is at Patchstack.
From Patchstack
WordPress 7.1.1 landed on 17 September 2026. It’s a security and maintenance release with 11 security fixes and 17 Core bug fixes. The headline issue is an unauthenticated stored cross-site scripting (XSS) vulnerability in wpautop(), the function that turns line breaks into paragraphs on nearly every piece of content WordPress renders.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.