{"uuid": "cd52c3ef-9092-4e92-aa25-3ed39ad7320b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/48312", "content": "\ud83d\udc80 CVE-2026-64638: XSS2Shell (WP login XSS to RCE)WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker\ud83d\udee0\ufe0f \n\nTOOLS:\n\nNuclei Template (Detection): https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64638.yaml\n\nExploit Tool (xss2shell): https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-\n\n\ud83d\udca5 IMPACT: Pre\u2011auth XSS \u2192 RCE. No credentials needed. Over 500M sites at risk.", "creation_timestamp": "2026-09-02T06:00:05.873644Z"}