{"uuid": "63f9b624-beee-4ca9-a3ca-7d11c35b979b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9775", "content": "\u26a1 ICYMI: One click from a logged-in #WordPress admin can trigger a chain from pre-auth XSS to PHP code execution.\n\nCVE-2026-64638 affects all WordPress versions, and the login-page XSS itself requires no authentication.\n\nPatch now:\nhttps://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "creation_timestamp": "2026-08-12T00:00:08.194232Z"}