{"vulnerability": "cve-2026-64638", "sightings": [{"uuid": "06869c0e-09e1-47b5-a8b1-827299f06e44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97051", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-WP-XSS2Shell-CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 686f6c61\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 16:55:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC funcional de CVE-2026-64638 (XSS2Shell): cadena pre-auth XSS a RCE en WordPress Core. Laboratorio Docker + servidor atacante Python + an\u00e1lisis t\u00e9cnico y mitigaci\u00f3n.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-07T18:00:03.597757Z"}, {"uuid": "929acba6-3882-416e-a6c2-960449e44582", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97055", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 17:04:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nXSS2Shell (CVE-2026-64638) PoC \u2014 WordPress pre-auth XSS to RCE chain (authorized testing only)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-07T18:00:03.537138Z"}, {"uuid": "0615c7f1-82b1-412a-8a9f-06d9709a7c58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3msjaepkch22s", "content": "#Wordpress: A Critical pre-auth #XSS to RCE vulnerability chain (CVE-2026-64638) dubbed #XSS2Shell is affecting all versions of WordPress Core. This vulnerability was discovered by AI (@pwn_ai). Patch to v7.0.3 ASAP - older versions backported:\n\ud83d\udc47\nthehackernews.com/2026/08/new-...", "creation_timestamp": "2026-08-07T18:58:00.765734Z"}, {"uuid": "69bf9c11-82f2-4f1f-8bbe-39c42a788e84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97062", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wordsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 18:32:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordpress Pre-auth XSS to RCE exploit PoC (xss2shell & CVE-2026-64638)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-07T20:00:04.481702Z"}, {"uuid": "94334372-fb00-4cfe-86e6-4100599e005b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117055999686008089", "content": "\ud83d\udea8 WordPress patches XSS2Shell flaw that could lead to server code execution\nCVE-2026-64638 is a CVSS 8.9 pre-authentication XSS vulnerability in the WordPress login screen.\nThe XSS itself requires no account. Researchers at pwn.ai demonstrated how it can be chained against a logged-in administrator to reach PHP code execution after social engineering the admin into interacting with an attacker-controlled page.\nA successful chain could potentially allow attackers to:\n\u2022 Create API credentials\u2022 Gain authenticated REST access\u2022 Upload malicious plugin files\u2022 Execute PHP on the server\u2022 Access WordPress secrets and database credentials\nWordPress 7.0.3 fixes the flaw, with patches backported through the 4.7 branch.\nNHS England says exploitation is likely following the release of technical details and a PoC.\nWordPress has not reported confirmed exploitation in the wild as of August 7.\nUpdate immediately.", "creation_timestamp": "2026-08-07T20:00:08.521568Z"}, {"uuid": "61f96c3d-1507-4335-8557-fc7d8f02aa7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64638.yaml", "content": "", "creation_timestamp": "2026-08-07T21:00:05.081414Z"}, {"uuid": "c8beb7b5-544e-48c4-977a-859aece6b1fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97055", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 17:04:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nXSS2Shell (CVE-2026-64638) PoC \u2014 WordPress pre-auth XSS to RCE chain (authorized testing only)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T00:02:16.012080Z"}, {"uuid": "a0034809-7ad0-4893-b9ec-edb7054562f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97062", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wordsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 18:32:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordpress Pre-auth XSS to RCE exploit PoC (xss2shell & CVE-2026-64638)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T00:02:15.430550Z"}, {"uuid": "0970767b-1761-4491-b5b8-f9aabb76bd98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97051", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-WP-XSS2Shell-CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 686f6c61\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 16:55:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC funcional de CVE-2026-64638 (XSS2Shell): cadena pre-auth XSS a RCE en WordPress Core. Laboratorio Docker + servidor atacante Python + an\u00e1lisis t\u00e9cnico y mitigaci\u00f3n.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T00:04:26.154629Z"}, {"uuid": "0b0f78c3-0d70-440e-b499-57d3864c2616", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9746", "content": "\u203c\ufe0f BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.\n\nXSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.\n\nUpdate your WordPress sites ASAP \ud83e\udc16 https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "creation_timestamp": "2026-08-08T00:06:19.837783Z"}, {"uuid": "42b0faf9-95f2-4697-bd69-903f10d357f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97094", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-WordPress-Core-XSS2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a renzi25031469\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 23:51:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTemplate Nuclei para detec\u00e7\u00e3o n\u00e3o-intrusiva do XSS2Shell, um parser differential pr\u00e9-autenticado no WordPress Core que permite inje\u00e7\u00e3o de elementos DOM na p\u00e1gina de login, servindo de base para uma cadeia de XSS \u2192 RCE.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T01:00:03.911020Z"}, {"uuid": "ee36c595-8051-49c1-b083-75168874ca74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "content": "WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.\n\nTracked as CVE-2026-64638 (CVSS score: 8.9), the", "creation_timestamp": "2026-08-08T01:00:33.813319Z"}, {"uuid": "c792cc9c-ed79-41fe-afcd-42119d3f20fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-64638.yaml", "content": "", "creation_timestamp": "2026-08-08T03:00:05.039879Z"}, {"uuid": "5bd0762b-d5e0-41e2-a1a4-555aa573585b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3msk6dufe5c2x", "content": "WordPress XSS2Shell CVE-2026-64638: A Critical Login-Page Flaw That Could Turn a Simple XSS Into Full Server\u00a0Takeover\n\nIntroduction: When the WordPress Login Page Becomes the Attack Surface WordPress powers an enormous portion of the modern web, which makes vulnerabilities in its core components\u2026", "creation_timestamp": "2026-08-08T03:54:25.166157Z"}, {"uuid": "a3a0b7dd-1607-4e54-814e-2fae2661e1f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97107", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imbas007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 01:24:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-64638: WordPress Pre-auth XSS \u2192 RCE (XSS2Shell) PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T04:00:04.880600Z"}, {"uuid": "c7f36021-8578-4db0-84f8-9a4faa068c5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/cybercod.bsky.social/post/3mskm4cjmst2s", "content": "Heads up! CVE-2026-64638 isn't a valid ID yet, and the WordPress/Debian info seems mixed. Be sure to verify alerts via official sources like NVD or MITRE. Stay safe! \ud83d\udee1\ufe0f", "creation_timestamp": "2026-08-08T08:00:43.294308Z"}, {"uuid": "cdad8c99-663b-46cf-b80f-98a54f37639f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97142", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #POC #CVE #Reflected\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell-CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yogaGymn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 07:19:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T09:00:03.931718Z"}, {"uuid": "faed7e47-5934-4e4b-8782-450427047845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97145", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 4minx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 08:58:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-64638 (XSS2shell) POC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T10:00:04.154324Z"}, {"uuid": "c7c7034b-03cd-42f5-98d2-932ef6642b94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97146", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 08:57:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nXSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE PoC mirror \u2014 WordSec, MIT; for authorized security testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T10:00:04.213920Z"}, {"uuid": "fb120757-bfb3-4b05-b8b3-078a56b780a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/GithubRedTeam/97148", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a XSS2Shell-CVE-2026-64638\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Linuxhackingid-official\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 08:12:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-64638 \u2014 WordPress Pre-Auth Reflected XSS \u2192 RCE via DOM Clobbering + Application Password Theft + REST API Plugin Activation. Dual-mode PoC (XSS chain & direct).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T10:00:04.252207Z"}, {"uuid": "ce9c3f6d-2853-498c-ab8d-8e2a7173f624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/bontchev.infosec.exchange.ap.brid.gy/post/3msl5l4dfdm42", "content": "WordPress RCE. Every version ever released (except the latest, 7.0.3). 500+ million sites. 43% of the Internet-facing sites. Hacker's paradise.\n\n\"XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)\":\n\nhttps://pwn.ai/blog/xss2shell", "creation_timestamp": "2026-08-08T13:13:15.987838Z"}, {"uuid": "14d1522c-472a-43fc-b938-4e2720fbfecb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/ifin-intel.org/post/3msl7f526ln24", "content": "You mean there's another serious vulnerability in WordPress core? CVE-2026-64638 chains cross-site scripting to code execution.\n\nIf you aren't already on 7.0.3, please patch ASAP. Also, consider limiting login page access.\n\ndiscourse.ifin.netwo...\n\n#CVE #IFIN #ThreatIntel #ThreatIntelligence", "creation_timestamp": "2026-08-08T13:45:41.296011Z"}, {"uuid": "7bea11d0-3475-4afc-843e-f5bd781da9c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64638", "type": "seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117060189477473635", "content": "You mean there's another serious vulnerability in WordPress core? CVE-2026-64638 chains cross-site scripting to code execution.\nIf you aren't already on 7.0.3, please patch ASAP. Also, consider limiting login page access.\nhttps://discourse.ifin.network/t/cve-2026-64638-xss2shell-does-what-it-says-patch-wordpress-now/729\n#CVE #IFIN #ThreatIntel #ThreatIntelligence", "creation_timestamp": "2026-08-08T13:46:01.443271Z"}, {"uuid": "8e09ef1f-a149-4779-b3ec-a48b7963f8bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97166", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64638-PoC-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tc4dy\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 11:56:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udee1\ufe0f CVE-2026-64638 - WordPress Security Assessment Suite (CVSS 8.9) | WordPress 4.7.0-7.0.2 pentest toolkit. Includes vulnerability assessment & advanced analysis modules. \ud83d\udc0d Safe Check & Exploit, 2 mode. Advanced Blue&Red Team Best 2026-64638 Toolkit, Authorized use only. Stay Legal <3zd\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T14:02:14.332752Z"}, {"uuid": "5f80a35e-5fab-4068-9747-776b80b73ee2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97180", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a poc-CVE-2026-64638-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mohwahyudi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 13:13:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T15:00:03.369536Z"}, {"uuid": "78053867-0639-4371-8489-04afd97ab8a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mslfzj57222e", "content": "\ud83d\udea8 XSS2shell (CVE-2026-64638) has been identified as a notable vulnerability.\n\n\u2139\ufe0f Additional details on ZEN SecDB secdb.nttzen.cloud/updates/267d...", "creation_timestamp": "2026-08-08T15:44:27.551460Z"}, {"uuid": "400e76d1-0d8c-415c-9841-ab6ad3b2a223", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mslu5csh3g2f", "content": "WordPress fixes CVE-2026-64638, a pre-auth login XSS affecting every version, with a demonstrated path to PHP execution under specific conditions.", "creation_timestamp": "2026-08-08T19:57:07.548639Z"}, {"uuid": "ea8e20d1-39a4-4077-af51-d7740e27e752", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mshh4queez2r", "content": "WordPress 7.0.3 fixes CVE-2026-64638, a pre-auth XSS on the login screen that can escalate to remote code execution. CVSS 8.9. Update now.\n\n#WordPress #XSS #RCE #CVE #CyberSecurity", "creation_timestamp": "2026-08-07T01:53:30.652231Z"}, {"uuid": "6ef7aedf-7abb-4dd4-9008-bdce9842582d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/117054394427524887", "content": "\u203c\ufe0f BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.\nXSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.\nUpdate your WordPress sites ASAP \ud83e\udc16 https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "creation_timestamp": "2026-08-07T13:11:54.359671Z"}, {"uuid": "9a6b8050-778d-48ba-a251-76d0003205f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9746", "content": "\u203c\ufe0f BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.\n\nXSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.\n\nUpdate your WordPress sites ASAP \ud83e\udc16 https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "creation_timestamp": "2026-08-07T14:00:04.037857Z"}, {"uuid": "1c7382ec-a7bf-487f-97d0-c9ae1a07f546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-64638", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3msiw4ylbch2i", "content": "New WordPress Pre-Authentication XSS Could Lead to PHP Code Execution, Patch\u00a0Immediately\n\nLearn how CVE-2026-64638 affects WordPress, why the pre-authentication XSS is dangerous, how researchers chained it\u2026\n\nhttps://thecybersecguru.com/news/wordpress-cve-2026-64638-pre-auth-xss-php-code-execution/", "creation_timestamp": "2026-08-07T15:54:45.059204Z"}, {"uuid": "1ff99777-e4df-43de-8929-2fa4737cc9a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html", "content": "WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.\n\nTracked as CVE-2026-64638 (CVSS score: 8.9), the", "creation_timestamp": "2026-08-07T16:01:14.262709Z"}]}