{"uuid": "6ef7aedf-7abb-4dd4-9008-bdce9842582d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/117054394427524887", "content": "\u203c\ufe0f BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.\nXSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.\nUpdate your WordPress sites ASAP \ud83e\udc16 https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "creation_timestamp": "2026-08-07T13:11:54.359671Z"}