Security vulnerabilities identified in WordPress and GNU Aspell

Security researchers have identified critical vulnerabilities in both WordPress and GNU Aspell software.

A Cross-Site Scripting (XSS) vulnerability in the WordPress comment system, designated as CVE-2026-93485, could allow unauthenticated users to escalate privileges to Remote Code Execution (RCE). By injecting a specially crafted comment, an attacker could execute malicious JavaScript that, if viewed by a logged-in administrator, could upload malicious plugins to the server. This issue has been addressed in WordPress version 7.1.1.

Separately, CERT Polska has coordinated the disclosure of multiple vulnerabilities in GNU Aspell software affecting versions below 0.60.8.3. These include a heap-based buffer overflow (CVE-2026-75818) in the prezip-bin component, an out-of-bounds read (CVE-2026-75819) in the dictionary loading function, and an integer overflow (CVE-2026-75820). These flaws could lead to process crashes or memory data leaks when processing malicious files or dictionaries.