CVE-2026-64638

This PoC exploits CVE-2026-64638, a pre-authentication reflected XSS in WordPress's wp-login.php due to parsing discrepancies between PHP's strip_tags() and WordPress's KSES. The exploit chains DOM clobbering, Same Origin Method Execution (SOME), and Application Password theft to achieve unauthenticated RCE via plugin upload.

This PoC demonstrates a pre-authentication reflected XSS vulnerability (CVE-2026-64638) in WordPress core (versions 6.4–7.0.2) via a parser differential between `strip_tags()` and `wp_kses_post()`. The exploit auto-submits a crafted login request to trigger JavaScript execution in the WordPress origin, with potential for RCE chaining.

This PoC demonstrates a stored XSS vulnerability in WordPress 7.0.2 via improper HTML escaping in the login username field. The exploit uses a proxy to inject malicious JavaScript that is later executed when the payload is rendered in the admin interface.

This repository contains a functional proof-of-concept exploit for CVE-2026-64638, a pre-authentication XSS vulnerability in WordPress that can be chained to create an administrative backdoor account. The exploit leverages unsanitized user input in the login username field and a missing `wp_kses_post` filter in admin notices to execute JavaScript in an admin's session context.

This repository provides a functional proof-of-concept for CVE-2026-64638, a pre-authentication XSS vulnerability in WordPress (4.7–7.0.2) that chains DOM clobbering, JSONP callback manipulation, and Same Origin Method Execution (SOME) to achieve RCE via plugin upload. The exploit leverages a parser differential in `sanitize_user()` allowing HTML elements like `< area>` to bypass sanitization while being parsed by browsers.

The repository claims to be a PoC for CVE-2026-64638, a WordPress pre-auth XSS to RCE chain, but the exploit.py file contains extensive C2 (Command and Control) infrastructure, privilege escalation modules, and offensive tooling unrelated to the stated vulnerability. The code is overly complex for a simple XSS PoC and includes deceptive elements like C2 beaconing and task execution.

This repository provides a functional exploit for CVE-2026-64638, a pre-authentication XSS vulnerability in WordPress that can be chained to achieve RCE. The exploit includes both direct (credential-based) and XSS-based attack modes, with a callback server to capture application passwords and a plugin upload mechanism for RCE.

This repository provides a full exploit chain for CVE-2026-64638, a pre-authenticated XSS vulnerability in WordPress 7.0.2 that can be escalated to RCE via Application Password creation and malicious plugin upload. The PoC includes a scanner, callback server, and multi-stage exploit demonstrating the attack path.

This repository contains a Nuclei YAML template that detects the CVE-2026-64638 WordPress Core parser differential vulnerability, which allows pre-authenticated DOM element injection via inconsistent sanitization between `wp_strip_all_tags()` and `wp_kses_post()`. The template confirms reflection of injected HTML elements but does not exploit the full XSS→RCE chain.

CVE-2026-64638 is a pre-authentication reflected XSS vulnerability in WordPress (versions 4.7.0–7.0.2) due to improper sanitization of the username field on failed login attempts. Under specific conditions, it can be chained into RCE (dubbed XSS2Shell) if a logged-in administrator interacts with attacker-controlled content.

This PoC exploits CVE-2026-64638, a pre-authentication XSS vulnerability in WordPress (versions prior to the August 2026 backport fix) that can be chained to achieve RCE. The exploit uses reflected XSS to steal application passwords, then uploads a malicious plugin to execute commands or establish a reverse shell.

This PoC exploits CVE-2026-64638, a pre-authentication XSS vulnerability in WordPress (versions prior to the August 2026 backport fix) that can be chained to achieve RCE. The exploit leverages a reflected XSS in the login page to steal application passwords, then uploads a malicious plugin to execute commands or establish a reverse shell.

This repository contains a functional proof-of-concept exploit for CVE-2026-64638, a stored XSS vulnerability in WordPress that chains with Application Password creation to achieve unauthenticated remote code execution (RCE). The exploit leverages a bypass in `wp_kses_post` to inject malicious JavaScript into the login error page, then uses the SOME (Same-Origin Method Execution) technique to hijack an admin session and upload a malicious plugin.

This PoC exploits CVE-2026-64638, a pre-authentication XSS vulnerability in WordPress, to capture an Application Password via social engineering (admin interaction required), then uses the stolen credentials to upload a malicious plugin containing a webshell for RCE.

This repository contains a functional exploit chain for CVE-2026-64638, a pre-authentication reflected XSS in WordPress's wp-login.php that can be escalated to RCE when chained against a logged-in administrator. The PoC demonstrates the full attack flow, including DOM injection, autonomous request triggering, and plugin-based webshell deployment.

This repository provides a functional exploit chain for CVE-2026-64638, a pre-authentication XSS vulnerability in WordPress that can lead to remote code execution (RCE) via a combination of XSS injection, application password abuse, and REST API manipulation. The exploit targets WordPress versions before 7.0.3.