/Vulnerability Library

WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)

CVE-2026-64638
Verified

Description

Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638). The flaw exploits a parser differential between PHP strip_tags() and WordPress KSES. Tags with whitespace after < (e.g. "< area") survive strip_tags() but are normalized to valid HTML by KSES, leading to attacker-controlled DOM elements that trigger automatic JavaScript execution via user-profile.js. No user interaction required. Affects all WordPress versions < 7.0.3.

Severity

High

CVSS Score

8.9

Exploit Probability

31%

Published Date

August 7, 2026

Template Author

flx | nick vidovic (greenhats)

CVE-2026-64638.yaml
8.9Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-64638
CWE ID:
cwe-79

References

https://pwn.ai/blog/xss2shellhttps://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.htmlhttps://nvd.nist.gov/vuln/detail/CVE-2026-64638https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

Remediation Steps

Upgrade WordPress to 7.0.3 or apply the backported security patch.