If you run a WordPress website, there is a recent security update worth checking.<\/p>\n
CVE-2026-93485 is a vulnerability affecting WordPress Core. It has been fixed in WordPress 7.1.1 and patched versions of a number of older WordPress branches.<\/p>\n
WordPress released the update on 17 September 2026 and recommends that website owners install the security release immediately.<\/p>\n
The vulnerability is a type of stored cross-site scripting, usually shortened to stored XSS.<\/p>\n
It affects WordPress paragraph formatting and, under the documented conditions, could allow an unauthenticated visitor to insert malicious script into a website. The WordPress security notice says exploitation of this issue is subject to comment approval.<\/p>\n
The vulnerability has a CVSS score of 7.1, which is rated High under CVSS 3.1.<\/p>\n
In simple terms, cross-site scripting can allow unwanted JavaScript to run in another person’s browser when they visit an affected page.<\/p>\n
That is a good reason to update an affected WordPress installation rather than leave it exposed unnecessarily.<\/p>\n
A large number of WordPress versions received security fixes.<\/p>\n
The current WordPress release is 7.1.1, while patched releases were also issued for older branches including 7.0, 6.9, 6.8, 6.7 and several earlier versions.<\/p>\n
For example:<\/p>\n
– WordPress 7.0 users can update to 7.0.5
\n– WordPress 6.9 users can update to 6.9.8
\n– WordPress 6.8 users can update to 6.8.9
\n– WordPress 6.7 users can update to 6.7.8
\n– WordPress 6.6 users can update to 6.6.8<\/p>\n
Security releases were provided for older branches down to WordPress 4.7, although WordPress makes clear that only its latest release is actively supported. WordPress 4.6 and earlier no longer receive security updates.<\/p>\n
If you are running a much older WordPress version, it is worth looking beyond this particular vulnerability and reviewing whether the whole installation is still suitable to run.<\/p>\n
Have automatic WordPress Core updates switched on? The security update should be installed automatically.<\/p>\n
If automatic updates are switched off, you will need to update WordPress manually.<\/p>\n
Either way, check your WordPress dashboard and confirm that your site is running a patched version rather than assuming the update has already been applied.<\/p>\n
If a manual update is needed, install the appropriate patched release.<\/p>\n
Before carrying out a manual update, make sure you have a current backup.<\/p>\n
More importantly, make sure you know how that backup would be restored. Having backup files somewhere and having a workable recovery process are not quite the same thing.<\/p>\n
This CVE affects WordPress Core, but WordPress websites also depend on plugins and themes.<\/p>\n
Check those regularly for updates and remove anything you no longer use. An abandoned plugin can become an unnecessary security risk.<\/p>\n
Once an update is complete, test the important parts of the site.<\/p>\n
For a business website, that might include:<\/p>\n
– contact forms
\n– customer logins
\n– checkout pages
\n– payment integrations
\n– important plugins
\n– page layouts and navigation<\/p>\n
Updating promptly matters, but so does making sure the site still works properly afterwards.<\/p>\n
CVE-2026-93485 was not the only issue addressed by this release.<\/p>\n
WordPress 7.1.1 contained 11 security fixes, alongside maintenance fixes for WordPress Core and the Block Editor.<\/p>\n
Security updates are a normal part of running a website. WordPress itself, your plugins, themes and server software all change over time.<\/p>\n
The important thing is having a sensible process for dealing with them.<\/p>\n
For many small websites that means keeping updates enabled, maintaining reliable backups and checking the site regularly.<\/p>\n
For larger or more important websites, it may mean taking a more managed approach, where updates, recovery, performance and support form part of the wider hosting decision.<\/p>\n
As your website becomes more important to your business, hosting should make it easier to manage rather than becoming another job to worry about.<\/p>\n
WHUK provides WordPress hosting backed by real support, with a clear path to more capable hosting as your website grows.<\/p>\n
View our WordPress hosting plans to compare the available options, or speak to our team if you are unsure which setup is right for your website.<\/p>\n
Suggested sources for publication:<\/strong> If you run a WordPress website, there is a recent security update worth checking. CVE-2026-93485 is a vulnerability affecting WordPress Core. It has been fixed in WordPress 7.1.1 and patched…<\/p>\n
\n– CVE record<\/a>
\n– WordPress 7.1.1 release<\/a>
\n– WordPress 7.1.1 version notes<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"