{"vulnerability": "CVE-2026-64638", "sightings": [{"uuid": "06869c0e-09e1-47b5-a8b1-827299f06e44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97051", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-WP-XSS2Shell-CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 686f6c61\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 16:55:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC funcional de CVE-2026-64638 (XSS2Shell): cadena pre-auth XSS a RCE en WordPress Core. Laboratorio Docker + servidor atacante Python + an\u00e1lisis t\u00e9cnico y mitigaci\u00f3n.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-07T18:00:03.597757Z"}, {"uuid": "929acba6-3882-416e-a6c2-960449e44582", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97055", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 17:04:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nXSS2Shell (CVE-2026-64638) PoC \u2014 WordPress pre-auth XSS to RCE chain (authorized testing only)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-07T18:00:03.537138Z"}, {"uuid": "0615c7f1-82b1-412a-8a9f-06d9709a7c58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3msjaepkch22s", "content": "#Wordpress: A Critical pre-auth #XSS to RCE vulnerability chain (CVE-2026-64638) dubbed #XSS2Shell is affecting all versions of WordPress Core. This vulnerability was discovered by AI (@pwn_ai). Patch to v7.0.3 ASAP - older versions backported:\n\ud83d\udc47\nthehackernews.com/2026/08/new-...", "creation_timestamp": "2026-08-07T18:58:00.765734Z"}, {"uuid": "69bf9c11-82f2-4f1f-8bbe-39c42a788e84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97062", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wordsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 18:32:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordpress Pre-auth XSS to RCE exploit PoC (xss2shell & CVE-2026-64638)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-07T20:00:04.481702Z"}, {"uuid": "94334372-fb00-4cfe-86e6-4100599e005b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117055999686008089", "content": "\ud83d\udea8 WordPress patches XSS2Shell flaw that could lead to server code execution\nCVE-2026-64638 is a CVSS 8.9 pre-authentication XSS vulnerability in the WordPress login screen.\nThe XSS itself requires no account. Researchers at pwn.ai demonstrated how it can be chained against a logged-in administrator to reach PHP code execution after social engineering the admin into interacting with an attacker-controlled page.\nA successful chain could potentially allow attackers to:\n\u2022 Create API credentials\u2022 Gain authenticated REST access\u2022 Upload malicious plugin files\u2022 Execute PHP on the server\u2022 Access WordPress secrets and database credentials\nWordPress 7.0.3 fixes the flaw, with patches backported through the 4.7 branch.\nNHS England says exploitation is likely following the release of technical details and a PoC.\nWordPress has not reported confirmed exploitation in the wild as of August 7.\nUpdate immediately.", "creation_timestamp": "2026-08-07T20:00:08.521568Z"}, {"uuid": "61f96c3d-1507-4335-8557-fc7d8f02aa7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64638.yaml", "content": "", "creation_timestamp": "2026-08-07T21:00:05.081414Z"}, {"uuid": "c8beb7b5-544e-48c4-977a-859aece6b1fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97055", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 17:04:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nXSS2Shell (CVE-2026-64638) PoC \u2014 WordPress pre-auth XSS to RCE chain (authorized testing only)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T00:02:16.012080Z"}, {"uuid": "a0034809-7ad0-4893-b9ec-edb7054562f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97062", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wordsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 18:32:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordpress Pre-auth XSS to RCE exploit PoC (xss2shell & CVE-2026-64638)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T00:02:15.430550Z"}, {"uuid": "0970767b-1761-4491-b5b8-f9aabb76bd98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97051", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-WP-XSS2Shell-CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 686f6c61\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 16:55:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC funcional de CVE-2026-64638 (XSS2Shell): cadena pre-auth XSS a RCE en WordPress Core. Laboratorio Docker + servidor atacante Python + an\u00e1lisis t\u00e9cnico y mitigaci\u00f3n.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T00:04:26.154629Z"}, {"uuid": "0b0f78c3-0d70-440e-b499-57d3864c2616", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9746", "content": "\u203c\ufe0f BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.\n\nXSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.\n\nUpdate your WordPress sites ASAP \ud83e\udc16 https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "creation_timestamp": "2026-08-08T00:06:19.837783Z"}, {"uuid": "42b0faf9-95f2-4697-bd69-903f10d357f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97094", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-WordPress-Core-XSS2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a renzi25031469\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 23:51:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTemplate Nuclei para detec\u00e7\u00e3o n\u00e3o-intrusiva do XSS2Shell, um parser differential pr\u00e9-autenticado no WordPress Core que permite inje\u00e7\u00e3o de elementos DOM na p\u00e1gina de login, servindo de base para uma cadeia de XSS \u2192 RCE.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T01:00:03.911020Z"}, {"uuid": "ee36c595-8051-49c1-b083-75168874ca74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "content": "WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.\n\nTracked as CVE-2026-64638 (CVSS score: 8.9), the", "creation_timestamp": "2026-08-08T01:00:33.813319Z"}, {"uuid": "c792cc9c-ed79-41fe-afcd-42119d3f20fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64638.yaml", "content": "", "creation_timestamp": "2026-08-08T03:00:05.039879Z"}, {"uuid": "5bd0762b-d5e0-41e2-a1a4-555aa573585b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3msk6dufe5c2x", "content": "WordPress XSS2Shell CVE-2026-64638: A Critical Login-Page Flaw That Could Turn a Simple XSS Into Full Server\u00a0Takeover\n\nIntroduction: When the WordPress Login Page Becomes the Attack Surface WordPress powers an enormous portion of the modern web, which makes vulnerabilities in its core components\u2026", "creation_timestamp": "2026-08-08T03:54:25.166157Z"}, {"uuid": "a3a0b7dd-1607-4e54-814e-2fae2661e1f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97107", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imbas007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 01:24:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-64638: WordPress Pre-auth XSS \u2192 RCE (XSS2Shell) PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T04:00:04.880600Z"}, {"uuid": "c7f36021-8578-4db0-84f8-9a4faa068c5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/cybercod.bsky.social/post/3mskm4cjmst2s", "content": "Heads up! CVE-2026-64638 isn't a valid ID yet, and the WordPress/Debian info seems mixed. Be sure to verify alerts via official sources like NVD or MITRE. Stay safe! \ud83d\udee1\ufe0f", "creation_timestamp": "2026-08-08T08:00:43.294308Z"}, {"uuid": "cdad8c99-663b-46cf-b80f-98a54f37639f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97142", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #POC #CVE #Reflected\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell-CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yogaGymn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 07:19:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T09:00:03.931718Z"}, {"uuid": "ea8e20d1-39a4-4077-af51-d7740e27e752", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mshh4queez2r", "content": "WordPress 7.0.3 fixes CVE-2026-64638, a pre-auth XSS on the login screen that can escalate to remote code execution. CVSS 8.9. Update now.\n\n#WordPress #XSS #RCE #CVE #CyberSecurity", "creation_timestamp": "2026-08-07T01:53:30.652231Z"}, {"uuid": "6ef7aedf-7abb-4dd4-9008-bdce9842582d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/117054394427524887", "content": "\u203c\ufe0f BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.\nXSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.\nUpdate your WordPress sites ASAP \ud83e\udc16 https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "creation_timestamp": "2026-08-07T13:11:54.359671Z"}, {"uuid": "9a6b8050-778d-48ba-a251-76d0003205f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9746", "content": "\u203c\ufe0f BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.\n\nXSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.\n\nUpdate your WordPress sites ASAP \ud83e\udc16 https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "creation_timestamp": "2026-08-07T14:00:04.037857Z"}, {"uuid": "1c7382ec-a7bf-487f-97d0-c9ae1a07f546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64638", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3msiw4ylbch2i", "content": "New WordPress Pre-Authentication XSS Could Lead to PHP Code Execution, Patch\u00a0Immediately\n\nLearn how CVE-2026-64638 affects WordPress, why the pre-authentication XSS is dangerous, how researchers chained it\u2026\n\nhttps://thecybersecguru.com/news/wordpress-cve-2026-64638-pre-auth-xss-php-code-execution/", "creation_timestamp": "2026-08-07T15:54:45.059204Z"}, {"uuid": "1ff99777-e4df-43de-8929-2fa4737cc9a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "content": "WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.\n\nTracked as CVE-2026-64638 (CVSS score: 8.9), the", "creation_timestamp": "2026-08-07T16:01:14.262709Z"}]}