[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"vulnerability-29905":67,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":96,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":103,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":109},[4,15,24,32,40,47],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":13,"variant":14,"campaign_id":6},"Office Hours #14","office-hours-14","[Live Office Hours, Wed Oct 28] Check, patch, prove: PHP2Shell and other critical CVEs","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_xbwerEx9QFSjfNWIHcjtHw",true,[11,12],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot","secondary",{"title":16,"slug":17,"text":18,"link":19,"external":9,"targets":20,"cta":22,"variant":14,"campaign_id":23},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[21],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan","See pricing options","php2shell-rce",{"title":25,"slug":26,"text":27,"link":28,"external":29,"targets":30,"cta":28,"variant":14,"campaign_id":23},"PHP2Shell & Node2Shell detection - pricing page","php2shell-rce-pricing","PHP2Shell & Node2Shell detection live in every paid plan (unlimited rescans for patch validation)",null,false,[31],"\u002Fpricing",{"title":33,"slug":34,"text":35,"link":19,"external":9,"targets":36,"cta":22,"variant":14,"campaign_id":34},"Node2Shell detection - Vuln DB homepage, product, CVE page","node2shell","🚨 Detect Node2Shell with any paid plan. Get proof now",[37,38,39],"\u002Fvulnerabilities-exploits","\u002Fproduct","\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",{"title":41,"slug":42,"text":43,"link":19,"external":9,"targets":44,"cta":46,"variant":14,"campaign_id":23},"PHP2Shell detection - NetScan on the NS page","php2shell-rce-netscan","🚨 Detect Node2Shell + PHP2Shell with NetScan (from $96\u002Fmo for 16 assets)",[45],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick NetScan",{"title":48,"slug":23,"text":49,"link":19,"external":9,"targets":50,"cta":22,"variant":14,"campaign_id":23},"PHP2Shell detection - top pages, pricing CTA","🚨 Detect Node2Shell + PHP2Shell with any paid plan. Get proof",[51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams",{"id":68,"detectable_with":69,"vuln_details":76,"vuln_id":93,"name":94,"published":95,"updated":28},29905,{"tool":70,"engine":73},{"id":71,"name":72},1,"Network Scanner",{"id":74,"name":75},2,"Nuclei",{"id":68,"codename":28,"description":28,"severity":77,"risk_description":78,"public_description":79,"public_recommendation":80,"recommendation":28,"references":81,"cvssv3":86,"epss_score":87,"epss_percentile":88,"cve":89,"in_cisa_catalog":29,"date":91,"software_type":28,"vendor":92,"product":92,"ptt_exploit_capabilities":28},"high","An unauthenticated attacker can store JavaScript in WordPress comments that executes automatically (zero-click) in every visitor's browser on affected pages.","WordPress core before 7.1.1 is vulnerable to unauthenticated stored XSS via crafted blockquote comments. wp_kses_post accepts a \u003Cblockquote> with a literal newline in the cite attribute, wpautop's non-quote-aware regex injects a \u003Cp> inside the cite value, and wptexturize leaves the attribute open so onfocus\u002Fautofocus land on \u003Ccode> as real HTML attributes, giving zero-click stored XSS. Only triggers when comments are open and auto-approved.","Update WordPress to 7.1.1 or a backport release (7.0.5+, 6.9.8+, 6.8.9+, down to 4.7.36+), which makes wpautop's blockquote regex quote-aware.",[82,83,84,85],"https:\u002F\u002Fwordpress.org\u002Fnews\u002F2026\u002F09\u002Fwordpress-7-1-1-maintenance-and-security-release\u002F","https:\u002F\u002Fgithub.com\u002F686f6c61\u002FPOC-WP-CORE-CVE-2026-93485","https:\u002F\u002Fgithub.com\u002FDeathShotXD\u002FComment2Shell","https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-93485",7.1,0.00354,0.28798,[90],"CVE-2026-93485","2026-09-18T00:00:00Z","wordpress","NETSCAN-NUCLEI-CVE-CVE-2026-93485","WordPress Core \u003C 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)","2026-10-26T00:00:00Z",["Island",97],{"key":98,"params":99,"result":101},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":100},"{}",{"head":102},{},["Island",104],{"key":105,"params":106,"result":107},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":100},{"head":108},{},["Island",110],{"key":111,"params":112,"result":114},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":113},"{\"text-color\":\"gray\"}",{"head":115},{}]