CVE

CVE-2026-64638

8.9

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

Attack Vector

Network

Privileges Req.

None

User Interaction

wordpress

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)

Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638). The flaw exploits a parser differential between PHP strip_tags() and WordPress KSES. Tags with whitespace after References: https://pwn.ai/blog/xss2shell https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html https://nvd.nist.gov/vuln/detail/CVE-2026-64638 https://wordpress.org/news/2026/08/wordpress-7-0-3-release/ Remediation: Upgrade WordPress to 7.0.3 or apply the backported security patch.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: wordpress

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →