`, which causes an insecure cascading transformation in the filters. With the correctly aligned payload, valid markup containing a JavaScript handler can be formed and processed in the final render.
Below is the high-level insecure transformation that can happen, where the event handler string that is initially processed as normal text inside a `` tag can be moved to become an attribute in the previous ``.
*The transformed payload at each step, from the submitted comment to the live event handler. Only the fourth step depends on block-template rendering.*
## (1) KSES allows a blockquote's cite attribute and newline
A comment containing `TEXT
` is allowed by KSES. The `blockquote[cite]` is one of the allowed HTML components.
[wp_kses_hair()](https://developer.wordpress.org/reference/functions/wp_kses_hair/) reads each attribute with [get_attribute()](https://developer.wordpress.org/reference/classes/wp_html_tag_processor/get_attribute/), which HTML-decodes character references, then re-encodes the result with a `strtr()` over certain syntax characters:
`wp-includes/kses.php:1721-1727`
```
$syntax_characters = array(
'&' => '&',
'<' => '<',
'>' => '>',
"'" => ''',
'"' => '"',
);
```
The `\n` is not in that map, so a newline inside an attribute value like `cite="a\nb"` can be used.
Alternatively, the encoded form of a newline, such as `cite="a
b"`, can also be used because WordPress will store it with the actual `\n`.
## (2) wpautop() replaces the newline with an HTML comment
`wpautop()` takes every newline that sits inside a tag and swaps it for an HTML comment:
`wp-includes/formatting.php:502`
```
// Find newlines in all elements and add placeholders.
$text = wp_replace_in_html_tags( $text, array( "\n" => ' ' ) );
```
What the rest of the function sees in its place is ``, a comment that carries a `>` of its own, which plays an important part in the next step.
## (3) wpautop() injects an unexpected tag
`wpautop()` puts a blank line above every block-level opening tag, and blockquote is on that list:
`wp-includes/formatting.php:490`
```
// Add a double line break above block-level opening tags.
$text = preg_replace( '!(<' . $allblocks . '[\s/>])!', "\n\n$1", $text );
```
So the `` always begins a paragraph of its own, whatever the comment contains, and the rebuild loop wraps that paragraph in a ``:
`wp-includes/formatting.php:539-548`
```
// Split up the contents into an array of strings, separated by double line breaks.
$paragraphs = preg_split( '/\n\s*\n/', $text, -1, PREG_SPLIT_NO_EMPTY );
// Reset $text prior to rebuilding.
$text = '';
// Rebuild the content as a string, wrapping every bit with a
.
foreach ( $paragraphs as $paragraph ) {
$text .= '
' . trim( $paragraph, "\n" ) . "
\n";
}
```
The whole `` stays in one piece and comes back out as ``.
There is an improper `preg_replace` in the formatting code.
`wp-includes/formatting.php:563`
```
$text = preg_replace( '|]*)>|i', '', $text );
```
`[^>]*` cannot cross a `>`, so it stops at the first one it meets, which is the `>` in the `` comment. The capture comes back as ` cite="a b"`, and the `
` lands after the `>` that really ends the tag.
# Timeline
- **8 September 2026** — Reported to the WordPress core team through the WordPress bug bounty program on HackerOne. The security team triaged it on the same day.
- **15 September 2026** — A CVE was requested from Patchstack.
- **17 September 2026** — [WordPress 7.1.1](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/) was released with the fix, together with backports for every supported branch down to 4.7.36.
- **18 September 2026** — Patchstack assigned [CVE-2026-93485](https://www.cve.org/CVERecord?id=CVE-2026-93485).
- **21 September 2026** — This research article was published.
Rafie Muhammad
Security researcher working on WordPress core, plugin, and theme vulnerability research.
## AI DISCLAIMER
AI assistance was used while testing this vulnerability and while preparing this article. Every payload, stored value, and rendered output shown here was reproduced on a local WordPress install and checked by the author.