Injection: WordPress Core - Pre-Authentication Reflected XSS (XSS2Shell)¶

Identifier: cve_2026_64638

Scanner(s) Support¶

GraphQL Scanner	REST Scanner	WebApp Scanner	ASM Scanner

Description¶

WordPress Core contains a pre-authentication reflected XSS on wp-login.php (XSS2Shell), where a parser differential between strip_tags() and KSES lets malformed tag-like input survive sanitization and render as live HTML, injecting attacker-controlled DOM elements that can be chained toward remote code execution against an administrator. An installation is affected until it receives the applicable security update: the fix ships in 7.0.3 and is backported to eligible branches down to 4.7, so a patched maintenance release on an older branch can remain numerically below 7.0.3. Remediate by updating to the current security release for the installed branch.

How we test: We confirm the target exposes a WordPress login page, then submit a failed login whose username carries a parser-differential payload ("< area id=ajaxurl ...>") and check whether the response reflects it back as a normalized "\" element, proving the sanitization bypass.

Reference:

Configuration¶

Example¶

Example configuration:

---
security_tests:
  cve_2026_64638:
    skip: false

Reference¶

`skip`¶

Type : boolean

Skip the test if true.