{"id":65735,"date":"2026-08-10T14:15:56","date_gmt":"2026-08-10T21:15:56","guid":{"rendered":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/"},"modified":"2026-08-10T14:15:56","modified_gmt":"2026-08-10T21:15:56","slug":"xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei","status":"publish","type":"post","link":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/","title":{"rendered":"XSS2Shell (CVE-2026-64638): WordPress Pre-Auth XSS to RCE Detection with Nuclei"},"content":{"rendered":"<p>On August 6, 2026, WordPress shipped 7.0.3 along with backports to every branch it still supports, all the way down to 4.7. Twenty-four releases in a single day. The headline issue in that wave is <strong>XSS2Shell<\/strong>, tracked as <strong>CVE-2026-64638<\/strong>: a pre-authentication reflected cross-site scripting flaw on the login screen that can be chained into PHP code execution. It was found and responsibly reported by the team at <a href=\"https:\/\/pwn.ai\/blog\/xss2shell\" rel=\"nofollow\" target=\"_blank\">pwn.ai<\/a>, whose write-up is the authoritative technical source.<\/p>\n<p>This advisory is three things. First, a plain-English explanation of what XSS2Shell actually is, including the part most coverage gets wrong. Second, a ready-to-run <strong>Nuclei detection template<\/strong> that stays accurate across all 24 branches instead of over-reporting on a naive version check. Third, a walkthrough of how to find every affected WordPress instance across an attack surface with <a href=\"\/wordpress\/sn1per-professional-2026\/\">Sn1per<\/a>.<\/p>\n<p>One thing to get straight up front, because it drives how urgently you should treat this. The XSS needs no account. The escalation to code execution does not stand alone: it needs an administrator with a live session to open an attacker-controlled page. That is a real and meaningful gap, and it is exactly why the CNA scored this 8.9 High rather than in the nines. If you patched <a href=\"\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/\">wp2shell (CVE-2026-63030)<\/a> last month and are wondering whether this is the same class of emergency, it is not. More on that below.<\/p>\n<h2 id=\"at-a-glance\">XSS2Shell at a glance<\/h2>\n<ul>\n<li><strong>CVE:<\/strong> CVE-2026-64638, CWE-79 (reflected cross-site scripting). Also tracked as <a href=\"https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-52p2-r8wf-jcrf\" rel=\"nofollow\" target=\"_blank\">GHSA-52p2-r8wf-jcrf<\/a>. Note this is a repository-level advisory: it resolves at that URL but was never ingested into the GitHub Global Advisory Database, so <code>github.com\/advisories\/GHSA-52p2-r8wf-jcrf<\/code> returns 404.<\/li>\n<li><strong>Impact:<\/strong> pre-authentication reflected XSS on <code>\/wp-login.php<\/code>, escalatable to PHP code execution against a logged-in administrator.<\/li>\n<li><strong>CVSS:<\/strong> 8.9 High, <code>CVSS:4.0\/AV:N\/AC:H\/AT:N\/PR:N\/UI:A\/VC:H\/VI:H\/VA:H\/SC:H\/SI:H\/SA:H<\/code> from the HackerOne CNA. Patchstack independently scores it 7.1. NVD has not completed its own analysis: the record is still in Received status, and the 8.9 shown there is the CNA score carried over as a Secondary metric, not an NVD Primary score.<\/li>\n<li><strong>Affected:<\/strong> every WordPress branch from 4.7.0 through 7.0.2 received the fix. The <strong>exploitable<\/strong> range is narrower: 6.4.0 through 7.0.2.<\/li>\n<li><strong>Fixed:<\/strong> 24 releases on August 6, 2026. 7.0.3 on the current branch; see the full table below for yours.<\/li>\n<li><strong>Exploited in the wild:<\/strong> no confirmed exploitation, and <strong>not in CISA KEV<\/strong> as of August 10, 2026.<\/li>\n<li><strong>Fix now:<\/strong> update Core. If you cannot, set <code>DISALLOW_FILE_MODS<\/code> and disable Application Passwords to break the escalation.<\/li>\n<\/ul>\n<h2 id=\"what-is-xss2shell\">What is XSS2Shell (CVE-2026-64638)?<\/h2>\n<p>XSS2Shell is a reflected XSS in the WordPress login screen&rsquo;s failed-login error message. When you submit a username that does not exist, or the wrong password for one that does, WordPress builds an error notice that includes the username you typed. On WordPress 5.8 and later, three of those messages in <code>wp-includes\/user.php<\/code> interpolated the submitted value into HTML without escaping it: two in <code>wp_authenticate_username_password()<\/code> (the invalid-username branch and the incorrect-password branch) and one in <code>wp_authenticate_email_password()<\/code>. The attacker-controlled value is the <code>log<\/code> POST parameter. The fix wraps each one in <code>esc_html()<\/code>.<\/p>\n<p>On 4.7 through 5.7 there are only two such sinks, because the unknown-username error on those branches is a static string that does not reflect anything you typed. The reflecting variant, &ldquo;The username <code>%s<\/code> is not registered on this site,&rdquo; first appears in 5.8. The same commit also hardened two non-login outputs in <code>register_new_user()<\/code> with <code>esc_url()<\/code> and <code>esc_attr()<\/code>, so the full change in <code>user.php<\/code> is five escaping fixes, not three.<\/p>\n<p>The interesting part is why it was ever exploitable, because WordPress does sanitize that value. This is not a missing sanitizer. It is a <strong>parser differential between two sanitizers that disagree about what counts as a tag.<\/strong><\/p>\n<p>The submitted username passes through <code>sanitize_user()<\/code> in non-strict mode, which calls <code>wp_strip_all_tags()<\/code>, which is built on PHP&rsquo;s <code>strip_tags()<\/code>. PHP&rsquo;s parser does not treat a <code>&lt;<\/code> followed by whitespace and then a tag name as the start of a tag, so a construct written that way is not stripped. It survives as ordinary-looking text. Later, when the error notice is rendered, it passes through the KSES tokenizer in <code>wp_kses_post()<\/code>. KSES is more permissive about whitespace, normalizes that same construct into a real element, and because the element in question is on the KSES allowlist, it is emitted as live markup.<\/p>\n<p>So the value survives the stripping stage precisely because <code>strip_tags()<\/code> does not think it is a tag, and then becomes a tag because KSES does. The second sanitizer re-materializes what the first one let through. That is the whole bug, and it is a genuinely elegant find.<\/p>\n<h3 id=\"how-it-works\">How the exploit chain reaches PHP<\/h3>\n<p>The XSS alone is a reflected script execution on a login page, which is not by itself catastrophic. Getting from there to code execution takes a chain, and the researchers documented it in full. In outline, and deliberately without payloads:<\/p>\n<p>The injected element carries <code>id<\/code> and <code>name<\/code> attributes, which makes it addressable as a named property on <code>window<\/code>. That is <strong>DOM clobbering<\/strong>: it lets an attacker overwrite a global variable that WordPress&rsquo;s own login-page JavaScript reads. The canonical element is <code>&lt;area&gt;<\/code>, and the choice is not arbitrary: <code>&lt;area&gt;<\/code> is on the KSES allowlist, and <code>HTMLAreaElement.toString()<\/code> returns the element&rsquo;s <code>href<\/code>, so clobbering the <code>ajaxurl<\/code> global with one yields a usable URL rather than a useless object. WordPress enqueues its <code>user-profile<\/code> script on the default login form, and that script both reads a bare <code>ajaxurl<\/code> and auto-clicks certain elements on load, so the attacker never needs to supply a <code>&lt;script&gt;<\/code> tag.<\/p>\n<p>The clobbered global redirects a jQuery <code>$.post()<\/code> to the REST API using <code>_jsonp<\/code> with a dotted callback name. Because the REST server returns <code>application\/javascript<\/code> and jQuery evaluates it, that &ldquo;callback&rdquo; becomes a <strong>Same-Origin Method Execution<\/strong> primitive: it invokes a method path in the administrator&rsquo;s authenticated window, specifically the <code>approve<\/code> submit button on the Application Passwords authorization screen. That delivers a valid Application Password for the admin account to the attacker.<\/p>\n<p>Getting from that credential to PHP takes one more hop than most summaries admit, and the detail matters. An Application Password cannot be used against <code>\/wp-admin\/update.php<\/code> at all: <code>wp_authenticate_application_password()<\/code> bails unless the request is a REST or XML-RPC request, and the plugin-upload branch separately enforces a <code>plugin-upload<\/code> nonce. So the attacker uses the credential over REST to publish a page containing their own JavaScript, navigates the administrator&rsquo;s browser to that same-origin page, and lets that script scrape the <code>plugin-upload<\/code> nonce from the plugin-install screen before POSTing the ZIP. Files under <code>wp-content\/plugins\/<\/code> are directly web-executable, so that is the PHP execution.<\/p>\n<p>We are deliberately <em>not<\/em> publishing a working exploit here. Everything below is detection only. That is the same line we took on <a href=\"\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/\">wp2shell<\/a> and on our earlier <a href=\"\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/\">SharePoint advisory<\/a>: explain the flaw, then ship a safe detection you can run at scale.<\/p>\n<h3 id=\"pre-auth-meaning\">What &ldquo;pre-auth&rdquo; does and does not mean here<\/h3>\n<p>&ldquo;Unauthenticated XSS to PHP code execution&rdquo; is a fair description, and it is what both the reporters and Hadrian use: the attacker needs no account at any point in the chain. What is not fair is compressing that to <strong>&ldquo;unauthenticated zero-click RCE,&rdquo;<\/strong> which is how it has been shorthanded in several write-ups.<\/p>\n<p>The CNA&rsquo;s own vector settles it. It carries <code>UI:A<\/code>, which in CVSS 4.0 is the <em>strongest<\/em> interaction requirement: a targeted user must perform specific, conscious interactions. There is no known path to code execution without an administrator, already logged in, visiting a page the attacker controls.<\/p>\n<p>Several other gates have to be open too, and one of them is easy to overlook. Application Passwords, which the chain steals, are only available when <code>wp_is_application_passwords_supported()<\/code> returns true, and that function is <code>is_ssl() || 'local' === wp_get_environment_type()<\/code>. <strong>A WordPress site not served over HTTPS cannot hand out an Application Password at all<\/strong>, so the chain dead-ends at the XSS. The <code>wp_is_application_passwords_available<\/code> filter, which several security plugins set to false, breaks it the same way. Plugin upload has to be permitted as well.<\/p>\n<p>The honest phrasing is: <strong>a pre-auth XSS that can be escalated to RCE against an administrator who takes the bait.<\/strong> The XSS half is genuinely unauthenticated and trivial to reach. The RCE half is a targeted phish against an HTTPS site with Application Passwords enabled.<\/p>\n<p>The contrast with last month&rsquo;s WordPress Core bug is worth drawing explicitly, because the two are a month apart and easy to conflate:<\/p>\n<table>\n<thead>\n<tr>\n<th>&nbsp;<\/th>\n<th>wp2shell (CVE-2026-63030)<\/th>\n<th>XSS2Shell (CVE-2026-64638)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>CVSS<\/td>\n<td>9.8 Critical (CVSS 3.1)<\/td>\n<td>8.9 High (CVSS 4.0); Patchstack says 7.1<\/td>\n<\/tr>\n<tr>\n<td>User interaction<\/td>\n<td>None (<code>UI:N<\/code>)<\/td>\n<td>Required (<code>UI:A<\/code>)<\/td>\n<\/tr>\n<tr>\n<td>CWE<\/td>\n<td>CWE-436 interpretation conflict<\/td>\n<td>CWE-79 cross-site scripting<\/td>\n<\/tr>\n<tr>\n<td>In CISA KEV<\/td>\n<td>Yes, added 2026-07-21<\/td>\n<td>No, as of 2026-08-10<\/td>\n<\/tr>\n<tr>\n<td>Fixed in<\/td>\n<td>7.0.2 \/ 6.9.5<\/td>\n<td>7.0.3 and 23 backports<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>One clarification on that last row, because it is easy to get wrong: the 6.8 branch was never affected by CVE-2026-63030 at all. WordPress 6.8.6 shipped the same day but fixed only the companion SQL injection, CVE-2026-60137. The route-confusion half reached 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 only.<\/p>\n<p>Patching one did not patch the other. If you updated to 7.0.2 in July, you are still exposed to this one.<\/p>\n<h2 id=\"affected-versions\">CVE-2026-64638 affected versions: all 24 WordPress branches<\/h2>\n<p>This is the part almost no published advisory answers properly. Nearly every write-up stops at &ldquo;fixed in 7.0.3, backported to 4.7,&rdquo; which does not tell an operator on 6.2 what to install. Worse, it invites a detection rule of the form &ldquo;flag anything below 7.0.3,&rdquo; which is wrong: a fully patched 6.8.7 site is numerically below 7.0.3 but is not vulnerable.<\/p>\n<p>Every branch has its own fix floor. The table below is cross-checked against <code>api.wordpress.org\/core\/stable-check\/1.0\/<\/code>, the authoritative machine-readable source for whether a given WordPress version is considered insecure.<\/p>\n<table>\n<thead>\n<tr>\n<th>Branch<\/th>\n<th>Fixed version<\/th>\n<th>Branch<\/th>\n<th>Fixed version<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>7.0<\/td>\n<td><strong>7.0.3<\/strong><\/td>\n<td>5.8<\/td>\n<td>5.8.14<\/td>\n<\/tr>\n<tr>\n<td>6.9<\/td>\n<td><strong>6.9.6<\/strong><\/td>\n<td>5.7<\/td>\n<td>5.7.16<\/td>\n<\/tr>\n<tr>\n<td>6.8<\/td>\n<td><strong>6.8.7<\/strong><\/td>\n<td>5.6<\/td>\n<td>5.6.18<\/td>\n<\/tr>\n<tr>\n<td>6.7<\/td>\n<td>6.7.6<\/td>\n<td>5.5<\/td>\n<td>5.5.19<\/td>\n<\/tr>\n<tr>\n<td>6.6<\/td>\n<td>6.6.6<\/td>\n<td>5.4<\/td>\n<td>5.4.20<\/td>\n<\/tr>\n<tr>\n<td>6.5<\/td>\n<td>6.5.9<\/td>\n<td>5.3<\/td>\n<td>5.3.22<\/td>\n<\/tr>\n<tr>\n<td>6.4<\/td>\n<td>6.4.9<\/td>\n<td>5.2<\/td>\n<td>5.2.25<\/td>\n<\/tr>\n<tr>\n<td>6.3<\/td>\n<td>6.3.9<\/td>\n<td>5.1<\/td>\n<td>5.1.23<\/td>\n<\/tr>\n<tr>\n<td>6.2<\/td>\n<td>6.2.10<\/td>\n<td>5.0<\/td>\n<td>5.0.26<\/td>\n<\/tr>\n<tr>\n<td>6.1<\/td>\n<td>6.1.11<\/td>\n<td>4.9<\/td>\n<td>4.9.30<\/td>\n<\/tr>\n<tr>\n<td>6.0<\/td>\n<td>6.0.13<\/td>\n<td>4.8<\/td>\n<td>4.8.29<\/td>\n<\/tr>\n<tr>\n<td>5.9<\/td>\n<td><strong>5.9.15<\/strong><\/td>\n<td>4.7<\/td>\n<td>4.7.34<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Two traps in that table.<\/p>\n<p><strong>5.9 is 5.9.15, not 5.9.14.<\/strong> WordPress released 5.9.14 on August 6 and then replaced it the same day because of a problem with the package. The stable-check API still reports 5.9.14 as <code>insecure<\/code>. Several summaries of this CVE list 5.9.14 as the fixed version. If you standardized on that, you are one release short.<\/p>\n<p><strong>Anything below 4.7 gets nothing, ever.<\/strong> Those branches are past end of life and no patch was issued. Per WordPress.org&rsquo;s own stats, roughly 1% of all installs sit there permanently.<\/p>\n<h3 id=\"why-63-not-exploitable\">Why WordPress 6.3 and earlier got a patch but are not exploitable<\/h3>\n<p>Here is a nuance we have not seen published anywhere except in passing by Hadrian, and which we verified directly against Core source rather than taking on trust.<\/p>\n<p>WordPress backported the <code>esc_html()<\/code> change all the way to 4.7, and the release notes for every one of those branches credit the pwn.ai login-screen XSS. That reads as &ldquo;all 24 branches are exploitable.&rdquo; They are not.<\/p>\n<p>The chain depends on the KSES re-normalization step, and that step only reaches the login screen from <strong>WordPress 6.4<\/strong>. In 6.4, <code>login_header()<\/code> switched to rendering errors through <code>wp_admin_notice()<\/code>, and that function does <code>echo wp_kses_post( wp_get_admin_notice( $message, $args ) )<\/code>. On 6.3 and earlier, <code>login_header()<\/code> echoes the error directly:<\/p>\n<pre><code>echo '&lt;div id=\"login_error\"&gt;' . apply_filters( 'login_errors', $errors ) . \"&lt;\/div&gt;\\n\";<\/code><\/pre>\n<p>No KSES pass, so nothing re-normalizes the construct back into a tag, so it stays inert text that a browser renders as literal characters. You can confirm the boundary yourself: <code>wp_admin_notice<\/code> appears in <code>wp-login.php<\/code> from 6.4 onward and is absent in 6.3.9 and every branch below it.<\/p>\n<p>There is a second, independent reason the old branches are safe, which makes the boundary over-determined rather than a single point of failure. On 4.7 through 5.7 the unknown-username error does not reflect the submitted value at all, so on those branches the attacker-controlled sink only fires for a username or email that actually exists.<\/p>\n<p>The practical consequence: the <strong>patched<\/strong> range and the <strong>exploitable<\/strong> range are different sets. 4.7.0 through 7.0.2 got the fix; 6.4.0 through 7.0.2 could actually be exploited <strong>through the WordPress Core login screen<\/strong>. A detection rule that treats them identically over-reports across seventeen branches. Our template reports them separately.<\/p>\n<p>One caveat, because the underlying flaw is broader than the login page. The <code>sanitize_user()<\/code> and <code>wp_kses_post()<\/code> differential is itself version-independent. Any plugin or theme that takes a <code>sanitize_user()<\/code> value and renders it through <code>wp_kses_post()<\/code>, or hooks <code>login_errors<\/code> and wraps the message in an admin-notice helper, re-creates the same sink on an older branch. The 6.4 boundary applies to Core&rsquo;s own login screen, not to every possible path in your install. Patch regardless of branch.<\/p>\n<h2 id=\"quick-checks\">Is my WordPress site vulnerable to CVE-2026-64638?<\/h2>\n<p>On a host you control, the authoritative check is WP-CLI from the WordPress root:<\/p>\n<pre><code>wp core version<\/code><\/pre>\n<p>Compare the result against your branch&rsquo;s row in the table above. An available update is not an installed update, so check the running version rather than the dashboard&rsquo;s intent.<\/p>\n<p>From outside, a stock install advertises its version in several public places:<\/p>\n<pre><code># Generator meta tag on the home page\ncurl -s https:\/\/example.com\/ | grep -i 'name=\"generator\"'\n\n# RSS feed generator - survives hardening more often than the meta tag\ncurl -s 'https:\/\/example.com\/?feed=rss2' | grep -i 'generator'\n\n# OPML generator\ncurl -s https:\/\/example.com\/wp-links-opml.php | grep -i generator<\/code><\/pre>\n<p>Two warnings about external version checks. Hardening plugins strip these markers routinely, so silence means &ldquo;unknown,&rdquo; not &ldquo;clean.&rdquo; And markers go stale: while researching this post we found a site whose homepage still advertised <code>?ver=6.9.4<\/code> from cache while its own feed reported 7.0.3. Never decide on a single marker.<\/p>\n<p>Do <strong>not<\/strong> try to test this by submitting a marker string to the login form. It does not work, and we verified why. <code>esc_html()<\/code> is a no-op on any harmless alphanumeric value, so a patched and an unpatched host return byte-identical output for a benign username. The only input that behaves differently is the injection construct itself, which is the exploit. There is no safe middle ground. A login probe would also fire <code>wp_login_failed<\/code> on every attempt, and roughly eight million installs run Wordfence, Limit Login Attempts, All In One WP Security or Solid Security, several of which lock out usernames as well as IPs.<\/p>\n<h2 id=\"nuclei-template\">XSS2Shell Nuclei template for CVE-2026-64638<\/h2>\n<p>The template below is the one shipped in Sn1per&rsquo;s curated set. It is GET-only and sends no login POST, no XSS payload, and no exploit traffic, so it is safe against production.<\/p>\n<p>It works in two tiers. The primary signal is a <strong>content oracle<\/strong> rather than a version string. The file <code>wp-admin\/js\/inline-edit-post.min.js<\/code> changed in every one of the 24 releases on August 6, swapping a concatenated <code>&lt;option&gt;<\/code> build for <code>new Option(...)<\/code>. We verified that across all 24 fixed tags and their immediate predecessors: the token is present in 24 of 24 fixed builds and absent in every predecessor. Because it is a static file rather than a version banner, it cannot be stripped by a hardening plugin or spoofed by a filter, and in a live survey it was readable on sites that had removed every version marker. Be clear about what it proves: it is a co-shipped change in the same release train, not the <code>esc_html()<\/code> fix itself, so it answers &ldquo;does this build carry its branch&rsquo;s August 6 release,&rdquo; which is the question that matters operationally.<\/p>\n<p>The second tier is per-branch version comparison, used to classify the finding and as a fallback when the oracle is blocked.<\/p>\n<pre><code>id: CVE-2026-64638\n\ninfo:\n  name: WordPress Core &lt; 7.0.3 - Pre-Auth Reflected XSS to PHP Code Execution (XSS2Shell)\n  author: xer0dayz\n  severity: high\n  description: |\n    WordPress Core is affected by \"XSS2Shell\" (CVE-2026-64638), a pre-authentication\n    reflected cross-site scripting flaw on the login screen that can be escalated to PHP\n    code execution against a logged-in administrator. The reflected value is the \"log\"\n    POST parameter submitted to \/wp-login.php. On WordPress 5.8 and later three\n    failed-login error messages in wp-includes\/user.php interpolated it into an HTML\n    error notice without escaping: wp_authenticate_username_password() (invalid-username\n    and incorrect-password branches) and wp_authenticate_email_password()\n    (incorrect-password branch), all fixed by wrapping the value in esc_html(). On\n    4.7-5.7 there are only two, because the unknown-username error is a static string on\n    those branches and reflects nothing.\n\n    Escalation to RCE additionally requires Application Passwords to be available, which\n    means the site must be served over HTTPS: wp_is_application_passwords_supported() is\n    is_ssl() || 'local' === wp_get_environment_type().\n\n    The root cause is a parser differential, not a missing sanitizer. sanitize_user() in\n    non-strict mode calls wp_strip_all_tags() -&gt; PHP strip_tags(), which does not treat\n    \"&lt;\" followed by whitespace and a tag name as a tag, so the construct survives\n    stripping. The KSES tokenizer in wp_kses_post() then re-normalizes that same\n    construct into a real, allowlisted element, re-materializing live markup.\n\n    This template is NON-DESTRUCTIVE and GET-only. It sends no login POST, no XSS\n    payload, and no exploit traffic. There is deliberately no \"benign marker\" login\n    probe: esc_html() is a no-op on any harmless alphanumeric value, so patched and\n    unpatched hosts return byte-identical output. The only input that discriminates is\n    the injection construct itself, which would be the exploit. A login POST would also\n    fire wp_login_failed on every attempt and risks lockout on the ~8M installs running\n    Wordfence, Limit Login Attempts, AIOS or Solid Security.\n\n    DETECTION STRATEGY - two tiers, in precedence order:\n\n    1. Content oracle (authoritative). GET \/wp-admin\/js\/inline-edit-post.min.js. That\n       file changed in every one of the 24 branch releases shipped on 2026-08-06,\n       replacing a concatenated &lt;option&gt; build with new Option(...). Presence of\n       \"new Option(\" therefore means the build carries the 2026-08-06 security release\n       for its branch; absence means it does not. Verified against all 24 fixed tags and\n       their predecessors. This is a release-level oracle - it is a co-shipped change in\n       the same release train, not the esc_html() fix itself - but it answers exactly\n       the question that matters, and unlike a version string it cannot be stripped or\n       spoofed by a hardening plugin.\n\n    2. Version fallback, used ONLY when the oracle is unreachable (403\/404\/WAF). Reads\n       patch-level version markers anchored to core-only sources.\n\n    TWO RANGES - do not conflate them:\n\n    (a) EXPLOITABLE: 6.4.0 - 7.0.2. The KSES step only reaches the login screen from\n    WordPress 6.4, when login_header() switched to wp_admin_notice(), which does\n    echo wp_kses_post( wp_get_admin_notice( ... ) ). On 6.3 and earlier login_header()\n    echoes the error directly, so the construct that survives strip_tags stays inert\n    text and the published chain does not fire.\n\n    (b) HARDENING BACKPORT ONLY: 4.7 - 6.3. WordPress applied the same esc_html() change\n    to these branches on 2026-08-06, but the sink is not reachable via the published\n    chain. Reported separately - treat as patch hygiene, not an exploitable finding.\n\n    A naive \"&lt; 7.0.3\" comparison is wrong twice over: it flags a fully patched 6.8.7\n    install as vulnerable, and it calls 4.7-6.3 exploitable when they are not. Every\n    branch is matched against its own fix floor, cross-checked against\n    api.wordpress.org\/core\/stable-check\/1.0\/.\n\n    Output note: a host that exposes several readable version markers reports once per\n    marker, with the same matcher name and version each time. Deduplicate on\n    (template-id, host) if you are ingesting the JSON.\n\n    Known blind spots, stated plainly. If the oracle is blocked AND every core version\n    marker is stripped, the template stays silent - that means \"unknown, check the host\",\n    not \"clean\". An advertised version can also lag the true patch state in either\n    direction, so confirm on-host with \"wp core version\" before acting on a finding.\n  remediation: |\n    Update WordPress Core to the fixed release for your branch (all released\n    2026-08-06): 7.0.3, 6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 6.4.9, 6.3.9, 6.2.10, 6.1.11,\n    6.0.13, 5.9.15, 5.8.14, 5.7.16, 5.6.18, 5.5.19, 5.4.20, 5.3.22, 5.2.25, 5.1.23,\n    5.0.26, 4.9.30, 4.8.29, or 4.7.34.\n\n    WordPress 5.9.14 shipped the same day and was then replaced by 5.9.15 because of a\n    packaging issue; api.wordpress.org\/core\/stable-check still reports 5.9.14 as\n    \"insecure\", so only 5.9.15 is a valid patched state on that branch.\n\n    Installs below 4.7 receive no fix and must move to a maintained branch. Verify with\n    \"wp core version\" - an available or approved update is not an installed one.\n\n    Compensating controls that break the RCE escalation without fixing the XSS: set\n    DISALLOW_FILE_MODS to block plugin upload, and disable Application Passwords if\n    unused. Note that a WAF rule keying on \"&lt;\" in the log parameter is weak - a\n    public WAF-bypass repository for this chain already exists.\n  reference:\n    - https:\/\/wordpress.org\/news\/2026\/08\/wordpress-7-0-3-release\/\n    - https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-64638\n    - https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-52p2-r8wf-jcrf\n    - https:\/\/pwn.ai\/blog\/xss2shell\n    - https:\/\/api.wordpress.org\/core\/stable-check\/1.0\/\n  classification:\n    cvss-metrics: CVSS:4.0\/AV:N\/AC:H\/AT:N\/PR:N\/UI:A\/VC:H\/VI:H\/VA:H\/SC:H\/SI:H\/SA:H\n    cvss-score: 8.9\n    cve-id: CVE-2026-64638\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: wordpress\n    product: wordpress\n    shodan-query: http.component:\"WordPress\"\n    fofa-query: app=\"WordPress\"\n  tags: cve,cve2026,wordpress,wp,xss2shell,xss,rce,unauth,login\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\/wp-admin\/js\/inline-edit-post.min.js\"\n      - \"{{BaseURL}}\/?feed=rss2\"\n      - \"{{BaseURL}}\"\n      - \"{{BaseURL}}\/wp-links-opml.php\"\n\n    redirects: true\n    max-redirects: 2\n    req-condition: true\n\n    matchers-condition: or\n    matchers:\n      # ---- TIER 2: version classification. Every clause is gated on the oracle NOT\n      # having proven the host patched, so a definitive tier-1 \"patched\" verdict can\n      # never be contradicted by a stale HTML marker (observed in the wild: a homepage\n      # advertising ver=6.9.4 while the same site's feed reported 7.0.3).\n      #\n      # Each clause is gated on a well-formed two- or three-part version. Two-part is\n      # deliberately accepted: WordPress names a branch's FIRST release \"x.y\", not\n      # \"x.y.0\" (api.wordpress.org\/core\/stable-check lists 6.9 and 7.0, never 6.9.0 or\n      # 7.0.0), and those are real releases flagged insecure. compare_versions coerces\n      # x.y to x.y.0, which is exactly right. Rejecting two-part strings would downgrade\n      # every genuine .0 install to an unclassified finding. The gate still rejects\n      # junk, and the extractor is anchored to core-only markers so a stray theme or\n      # jQuery version can never reach it.\n      - type: dsl\n        name: exploitable-7.0-below-7.0.3\n        dsl:\n          - &gt;\n            !(status_code_1 == 200 &amp;&amp; contains(body_1, 'inlineEditPost') &amp;&amp;\n              contains(body_1, 'new Option(')) &amp;&amp;\n            regex('^[0-9]+[.][0-9]+([.][0-9]+)?$', version) &amp;&amp;\n            compare_versions(version, '&gt;= 7.0.0', '&lt; 7.0.3')\n\n      - type: dsl\n        name: exploitable-6.9-below-6.9.6\n        dsl:\n          - &gt;\n            !(status_code_1 == 200 &amp;&amp; contains(body_1, 'inlineEditPost') &amp;&amp;\n              contains(body_1, 'new Option(')) &amp;&amp;\n            regex('^[0-9]+[.][0-9]+([.][0-9]+)?$', version) &amp;&amp;\n            compare_versions(version, '&gt;= 6.9.0', '&lt; 6.9.6')\n\n      - type: dsl\n        name: exploitable-6.8-below-6.8.7\n        dsl:\n          - &gt;\n            !(status_code_1 == 200 &amp;&amp; contains(body_1, 'inlineEditPost') &amp;&amp;\n              contains(body_1, 'new Option(')) &amp;&amp;\n            regex('^[0-9]+[.][0-9]+([.][0-9]+)?$', version) &amp;&amp;\n            compare_versions(version, '&gt;= 6.8.0', '&lt; 6.8.7')\n\n      - type: dsl\n        name: exploitable-6.4-through-6.7-below-branch-fix\n        dsl:\n          - &gt;\n            !(status_code_1 == 200 &amp;&amp; contains(body_1, 'inlineEditPost') &amp;&amp;\n              contains(body_1, 'new Option(')) &amp;&amp;\n            regex('^[0-9]+[.][0-9]+([.][0-9]+)?$', version) &amp;&amp;\n            (compare_versions(version, '&gt;= 6.7.0', '&lt; 6.7.6') ||\n             compare_versions(version, '&gt;= 6.6.0', '&lt; 6.6.6') ||\n             compare_versions(version, '&gt;= 6.5.0', '&lt; 6.5.9') ||\n             compare_versions(version, '&gt;= 6.4.0', '&lt; 6.4.9'))\n\n      - type: dsl\n        name: hardening-backport-only-6.0-through-6.3-below-branch-fix\n        dsl:\n          - &gt;\n            !(status_code_1 == 200 &amp;&amp; contains(body_1, 'inlineEditPost') &amp;&amp;\n              contains(body_1, 'new Option(')) &amp;&amp;\n            regex('^[0-9]+[.][0-9]+([.][0-9]+)?$', version) &amp;&amp;\n            (compare_versions(version, '&gt;= 6.3.0', '&lt; 6.3.9') ||\n             compare_versions(version, '&gt;= 6.2.0', '&lt; 6.2.10') ||\n             compare_versions(version, '&gt;= 6.1.0', '&lt; 6.1.11') ||\n             compare_versions(version, '&gt;= 6.0.0', '&lt; 6.0.13'))\n\n      - type: dsl\n        name: hardening-backport-only-5.x-below-branch-fix\n        dsl:\n          - &gt;\n            !(status_code_1 == 200 &amp;&amp; contains(body_1, 'inlineEditPost') &amp;&amp;\n              contains(body_1, 'new Option(')) &amp;&amp;\n            regex('^[0-9]+[.][0-9]+([.][0-9]+)?$', version) &amp;&amp;\n            (compare_versions(version, '&gt;= 5.9.0', '&lt; 5.9.15') ||\n             compare_versions(version, '&gt;= 5.8.0', '&lt; 5.8.14') ||\n             compare_versions(version, '&gt;= 5.7.0', '&lt; 5.7.16') ||\n             compare_versions(version, '&gt;= 5.6.0', '&lt; 5.6.18') ||\n             compare_versions(version, '&gt;= 5.5.0', '&lt; 5.5.19') ||\n             compare_versions(version, '&gt;= 5.4.0', '&lt; 5.4.20') ||\n             compare_versions(version, '&gt;= 5.3.0', '&lt; 5.3.22') ||\n             compare_versions(version, '&gt;= 5.2.0', '&lt; 5.2.25') ||\n             compare_versions(version, '&gt;= 5.1.0', '&lt; 5.1.23') ||\n             compare_versions(version, '&gt;= 5.0.0', '&lt; 5.0.26'))\n\n      - type: dsl\n        name: hardening-backport-only-4.x-below-branch-fix\n        dsl:\n          - &gt;\n            !(status_code_1 == 200 &amp;&amp; contains(body_1, 'inlineEditPost') &amp;&amp;\n              contains(body_1, 'new Option(')) &amp;&amp;\n            regex('^[0-9]+[.][0-9]+([.][0-9]+)?$', version) &amp;&amp;\n            (compare_versions(version, '&gt;= 4.9.0', '&lt; 4.9.30') ||\n             compare_versions(version, '&gt;= 4.8.0', '&lt; 4.8.29') ||\n             compare_versions(version, '&gt;= 4.7.0', '&lt; 4.7.34'))\n\n      # No shape guard here: any 4.6.x is unsupported regardless of patch level.\n      - type: dsl\n        name: eol-below-4.7-unsupported-no-fix-available\n        dsl:\n          - &gt;\n            !(status_code_1 == 200 &amp;&amp; contains(body_1, 'inlineEditPost') &amp;&amp;\n              contains(body_1, 'new Option(')) &amp;&amp;\n            compare_versions(version, '&lt; 4.7.0')\n\n      # Oracle says this build predates its branch's 2026-08-06 release, but no core\n      # version marker was readable, so exploitable vs hardening-only cannot be decided.\n      - type: dsl\n        name: confirmed-unpatched-core-asset-oracle-version-unknown\n        dsl:\n          - &gt;\n            status_code_1 == 200 &amp;&amp;\n            contains(body_1, 'inlineEditPost') &amp;&amp;\n            !contains(body_1, 'new Option(') &amp;&amp;\n            !regex('^[0-9]+[.][0-9]+([.][0-9]+)?$', version)\n\n    extractors:\n      # Anchored to core-only version markers. A generic \/wp-includes\/...?ver= pattern\n      # must NOT be used: it captures jQuery (?ver=3.7.1), jquery-migrate (3.4.1) and\n      # theme assets, which both pollutes the value and can drive a bogus\n      # \"below 4.7\" verdict on a fully patched site.\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '(?:content=\"WordPress |wordpress\\.org\/\\?v=|generator=\"WordPress\/|wp-emoji-release\\.min\\.js\\?ver=)([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)'\n\n      - type: regex\n        name: wordpress-version\n        part: body\n        group: 1\n        regex:\n          - '(?:content=\"WordPress |wordpress\\.org\/\\?v=|generator=\"WordPress\/|wp-emoji-release\\.min\\.js\\?ver=)([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)'<\/code><\/pre>\n<p>Save it as <code>CVE-2026-64638.yaml<\/code> and run it against a single target or a list of hosts:<\/p>\n<pre><code># Single target\nnuclei -t CVE-2026-64638.yaml -u https:\/\/example.com\/\n\n# A whole list of WordPress hosts\nnuclei -t CVE-2026-64638.yaml -l wordpress-hosts.txt\n\n# Example match against an affected 7.0.2 instance:\n[CVE-2026-64638:exploitable-7.0-below-7.0.3] [http] [high] https:\/\/example.com\/ [\"7.0.2\"]<\/code><\/pre>\n<p>The matcher name tells you immediately whether you are looking at something exploitable or merely unpatched. We validated the version logic with nuclei v3.11.1 against mock responders covering every branch boundary, including the cases that break naive templates: a patched 6.8.7 host stays clean, 5.9.14 is correctly flagged as below its 5.9.15 floor, and a bare <code>6.8<\/code> is correctly read as the 6.8 release rather than being discarded.<\/p>\n<p>Three design notes worth stealing if you write your own:<\/p>\n<p><strong>Anchor the <code>?ver=<\/code> regex to core-only markers.<\/strong> A generic <code>\/wp-includes\/.*\\?ver=<\/code> pattern captures jQuery at <code>?ver=3.7.1<\/code> and jquery-migrate at <code>?ver=3.4.1<\/code>. We caught this in testing on a fully patched site: the extractor returned <code>[\"3.4.1\",\"3.7.1\"]<\/code>, values that would drive a bogus &ldquo;below 4.7&rdquo; verdict. Match the generator tag, the feed and OPML generators, and the emoji release URL, and nothing else.<\/p>\n<p><strong>Do not reject two-part versions.<\/strong> This one is counter-intuitive. Nuclei&rsquo;s <code>compare_versions<\/code> coerces <code>6.8<\/code> to <code>6.8.0<\/code>, so the obvious hardening move is to demand a full three-part string. That is wrong for WordPress: a branch&rsquo;s first release is named <code>x.y<\/code>, not <code>x.y.0<\/code>. The stable-check API lists <code>6.9<\/code> and <code>7.0<\/code> and has no entries for <code>6.9.0<\/code> or <code>7.0.0<\/code>, and both are flagged <code>insecure<\/code>. Demand three parts and you quietly downgrade every genuine <code>.0<\/code> install to an unclassified finding. Accept two or three parts, and anchor the extractor instead.<\/p>\n<p><strong>Two honest blind spots.<\/strong> If the oracle is blocked and every version marker is stripped, the template stays silent, and silence means &ldquo;unknown, go check the host.&rdquo; And an advertised version can lag the true patch state in either direction, so confirm with <code>wp core version<\/code> before you act on a finding.<\/p>\n<h2 id=\"detection-at-scale\">Detecting XSS2Shell across your attack surface with Sn1per<\/h2>\n<p>One template against one URL is a spot check. The real problem is discovery: most organizations do not have a clean list of every WordPress instance they expose. A marketing microsite, a forgotten staging blog, a subsidiary&rsquo;s WordPress on a domain acquired two years ago. Those are the hosts that miss the automatic update and quietly sit on 7.0.2. Finding them is an <a href=\"\/wordpress\/external-attack-surface-management-with-sn1per\/\">attack-surface problem<\/a> before it is a scanning problem.<\/p>\n<p>Sn1per runs discovery and detection as one engine. It enumerates the surface (subdomains, live hosts, services, technologies), fingerprints what is running, and runs its curated Nuclei set, including this template, against everything it finds, into a persistent named workspace:<\/p>\n<pre><code># Discover the surface, then run web detections into a persistent workspace\nsniper -t example.com -m recon -w acme-wp\nsniper -t example.com -m web   -w acme-wp\n\n# Pull the findings back out via the JSON API (Sn1per Professional 2026)\ncurl -sk -H \"X-API-Key: $SN1PER_API_KEY\" \\\n  \"https:\/\/sn1per.local\/pro\/api.php?action=vulnerabilities&amp;workspace=acme-wp\" | jq '.'<\/code><\/pre>\n<p>Alongside the Nuclei template we added three checks to Sn1per&rsquo;s curated active set for this release. Two extract the actual Core version from the generator meta tag and the RSS generator, which Sn1per previously did not do at all: its WordPress templates detected that a site <em>was<\/em> WordPress but never which version. The third flags builds missing the August 6 release using the same content-oracle signature. Running the same command from cron or a CI\/CD pipeline re-checks the surface on a schedule, the model we cover in <a href=\"\/wordpress\/continuous-attack-surface-testing\/\">continuous attack surface testing<\/a> and <a href=\"\/wordpress\/automated-penetration-testing\/\">automated penetration testing<\/a>.<\/p>\n<p>Because Sn1per is self-hosted and Docker-first, the scan and the resulting list of your unpatched WordPress sites never leave your perimeter. For an inventory of what you have not patched yet, that <a href=\"\/wordpress\/best-on-prem-external-attack-surface-management-platform\/\">on-prem posture<\/a> is the point.<\/p>\n<h3 id=\"edition-comparison\">Which Sn1per edition fits<\/h3>\n<table>\n<thead>\n<tr>\n<th>Capability<\/th>\n<th>Community Edition<\/th>\n<th>Professional 2026<\/th>\n<th>Enterprise<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Curated Nuclei set incl. XSS2Shell template<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Discovery + detection engine<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Scale<\/td>\n<td>Single operator<\/td>\n<td>Up to 150 assets, single operator<\/td>\n<td>Near-unlimited, multi-operator<\/td>\n<\/tr>\n<tr>\n<td>Web UI + scheduled scans<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>JSON API + SIEM \/ ticketing export<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Multi-workspace \/ multi-team<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Self-hosted \/ on-prem<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><a href=\"\/wordpress\/sn1per-community-edition\/\">Sn1per Community Edition<\/a> is free and open-source and ships the same detection engine, so a spot check across a handful of hosts costs nothing. <a href=\"\/wordpress\/sn1per-professional-2026\/\">Sn1per Professional 2026<\/a> adds the web UI, scheduled scans, and the JSON API for teams that want continuous coverage and findings routed into a SIEM or ticket queue; live pricing is on the <a href=\"\/wordpress\/shop\/\">shop<\/a>. <a href=\"\/wordpress\/sn1per-enterprise\/\">Sn1per Enterprise<\/a> scales to near-unlimited assets with multi-operator, multi-workspace management for MSSPs and large security teams (custom quote). If you are weighing the two paid tiers, our <a href=\"\/wordpress\/sn1per-professional-vs-sn1per-enterprise-a-comprehensive-comparison\/\">Professional vs Enterprise comparison<\/a> breaks it down.<\/p>\n<h2 id=\"remediation\">Remediation and mitigation<\/h2>\n<p><strong>1. Patch. This is the only real fix.<\/strong> Update Core to your branch&rsquo;s fixed release from the table above. WordPress has shipped automatic background updates for minor releases by default since 3.7, so much of the population will self-patch without intervention. Verify rather than assume: auto-update is commonly disabled by managed hosts that pin versions, by the <code>AUTOMATIC_UPDATER_DISABLED<\/code> and <code>WP_AUTO_UPDATE_CORE<\/code> constants, by filesystem permissions, and on any install deployed from a Git checkout or a container image. Containerized WordPress does not auto-update at all; an image built before August 7 stays vulnerable until you rebuild it.<\/p>\n<p><strong>2. If you cannot patch immediately, break the escalation rather than the XSS.<\/strong> Setting <code>DISALLOW_FILE_MODS<\/code> blocks the plugin upload the chain terminates in, and disabling Application Passwords removes the credential the chain steals. Neither removes the cross-site scripting, and neither is a substitute for patching, but both cut the path to PHP execution.<\/p>\n<p><strong>3. Do not rely on a WAF rule that keys on <code>&lt;<\/code> in the <code>log<\/code> parameter.<\/strong> A WAF-bypass repository targeting this specific chain was published on August 9, three days after the patch. Signature rules against a parser differential are exactly the kind of control that gets bypassed.<\/p>\n<p><strong>4. Administrator hygiene is a real control here.<\/strong> Because the chain requires an authenticated admin to open a hostile page, ordinary anti-phishing discipline genuinely reduces risk: do not browse untrusted links from a session that is logged into wp-admin, and keep admin accounts separate from day-to-day browsing.<\/p>\n<h2 id=\"feedly-warning\">A warning about one widely-visible &ldquo;exploited in the wild&rdquo; claim<\/h2>\n<p>If you triage this CVE through a feed aggregator, you may see it flagged as exploited in the wild, with text describing attacks beginning August 2 that deploy a ransomware strain called StormEncryptor. <strong>That attribution is wrong<\/strong>, and it is the most likely way a defender gets misled about this vulnerability right now.<\/p>\n<p>StormEncryptor is deployed by Storm-1175, which Microsoft Threat Intelligence assesses as likely exploiting <strong>CVE-2026-18577<\/strong>, an authentication bypass in N-able N-central. That is an MSP remote-monitoring product with no relationship to WordPress. CVE-2026-18577 is in CISA&rsquo;s KEV catalog, added August 3, though note that KEV itself marks its ransomware-campaign use as unknown, so the ransomware linkage comes from Microsoft rather than from CISA. CVE-2026-64638 is not in KEV at all; we checked the catalog directly on August 10 (catalog version 2026.08.10, 1,662 entries) and it returns zero hits.<\/p>\n<p>The timeline also rules it out. XSS2Shell was privately reported, patched on August 6 and disclosed on August 7. Attacks could not have started on August 2 against a bug that was not public for another five days. The same aggregator page shows an EPSS score under 1%, contradicting its own badge.<\/p>\n<p>The accurate status as of August 10, 2026: no confirmed in-the-wild exploitation, no mass-scanning telemetry, and no KEV listing. That said, roughly two dozen public proof-of-concept repositories appeared within 72 hours of disclosure, several of them full chains. The researchers&rsquo; restraint in withholding the exploit lasted less than a day. Treat the clock as running even though the sirens are not.<\/p>\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n<p><strong>What is XSS2Shell?<\/strong> XSS2Shell is the name for CVE-2026-64638, a pre-authentication reflected cross-site scripting flaw on the WordPress login screen. The username submitted to <code>\/wp-login.php<\/code> was reflected unescaped into the failed-login error message. It can be chained to PHP code execution, but only against an administrator who is logged in and visits an attacker-controlled page.<\/p>\n<p><strong>Which WordPress versions are affected by CVE-2026-64638?<\/strong> Every branch from 4.7.0 through 7.0.2 received the fix on August 6, 2026, across 24 separate releases. The current-branch fix is 7.0.3, and the others are listed in the table above. The exploitable range is narrower than the patched range: only 6.4.0 through 7.0.2 can actually be exploited, because the KSES step the chain depends on only reaches the login screen from 6.4.<\/p>\n<p><strong>Is CVE-2026-64638 being exploited in the wild?<\/strong> No confirmed exploitation as of August 10, 2026, and it is not in the CISA KEV catalog. Be careful with feed aggregators: at least one incorrectly badges this CVE as exploited by attributing a StormEncryptor ransomware campaign to it, when that campaign is tied to CVE-2026-18577 in N-able N-central. Multiple public proof-of-concept exploits do exist.<\/p>\n<p><strong>Is CVE-2026-64638 a pre-auth RCE?<\/strong> The XSS is genuinely pre-authentication and needs no account, so &ldquo;unauthenticated XSS to RCE&rdquo; is fair. &ldquo;Zero-click RCE&rdquo; is not: escalation requires a logged-in administrator to visit an attacker-controlled page, which is why the CVSS 4.0 vector carries <code>UI:A<\/code> and the score is 8.9 High. It also requires the site to be served over HTTPS, because Application Passwords are unavailable otherwise. This is materially lower urgency than wp2shell (CVE-2026-63030), which needed no interaction and is in CISA KEV.<\/p>\n<p><strong>What is the fixed version for WordPress 5.9?<\/strong> 5.9.15, not 5.9.14. WordPress released 5.9.14 on August 6 and replaced it the same day because of a packaging problem. The WordPress stable-check API still reports 5.9.14 as insecure, so only 5.9.15 is a valid patched state on that branch.<\/p>\n<p><strong>Is the XSS2Shell Nuclei template safe to run in production?<\/strong> Yes. It is GET-only and sends no login POST, no XSS payload and no exploit traffic. It reads one static Core JavaScript file plus public version markers. There is deliberately no &ldquo;benign marker&rdquo; login probe, because <code>esc_html()<\/code> is a no-op on harmless input, so patched and unpatched hosts return identical output; the only input that discriminates is the exploit itself.<\/p>\n<p>XSS2Shell is a good reminder that two correct-looking sanitizers can combine into a vulnerability neither one has on its own. It is also a reminder that the sites which stay vulnerable are rarely the ones you are thinking about: they are the WordPress instances nobody remembered they had, on branches nobody realized were still in production. Patch what you know about today, then use the template above, or <a href=\"\/wordpress\/sn1per-community-edition\/\">Sn1per<\/a> across your whole surface, to find the rest.<\/p>\n<p><script type=\"application\/ld+json\">\n{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[\n{\"@type\":\"Question\",\"name\":\"What is XSS2Shell?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"XSS2Shell is the name for CVE-2026-64638, a pre-authentication reflected cross-site scripting flaw on the WordPress login screen. The username submitted to \/wp-login.php was reflected unescaped into the failed-login error message. It can be chained to PHP code execution, but only against an administrator who is logged in and visits an attacker-controlled page.\"}},\n{\"@type\":\"Question\",\"name\":\"Which WordPress versions are affected by CVE-2026-64638?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Every branch from 4.7.0 through 7.0.2 received the fix on August 6, 2026, across 24 separate releases. The current-branch fix is 7.0.3. The exploitable range is narrower than the patched range: only 6.4.0 through 7.0.2 can actually be exploited, because the KSES step the chain depends on only reaches the login screen from WordPress 6.4.\"}},\n{\"@type\":\"Question\",\"name\":\"Is CVE-2026-64638 being exploited in the wild?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"There is no confirmed exploitation as of August 10, 2026, and it is not in the CISA KEV catalog. Be careful with feed aggregators: at least one incorrectly badges this CVE as exploited by attributing a StormEncryptor ransomware campaign to it, when that campaign is tied to CVE-2026-18577 in N-able N-central. Multiple public proof-of-concept exploits do exist.\"}},\n{\"@type\":\"Question\",\"name\":\"Is CVE-2026-64638 a pre-auth RCE?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The XSS is genuinely pre-authentication and needs no account, so unauthenticated XSS to RCE is a fair description. Zero-click RCE is not: escalation requires a logged-in administrator to visit an attacker-controlled page, which is why the CVSS 4.0 vector carries UI:A and the score is 8.9 High. It also requires the site to be served over HTTPS, because Application Passwords are unavailable otherwise.\"}},\n{\"@type\":\"Question\",\"name\":\"What is the fixed version for WordPress 5.9?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"5.9.15, not 5.9.14. WordPress released 5.9.14 on August 6, 2026 and replaced it the same day because of a packaging problem. The WordPress stable-check API still reports 5.9.14 as insecure, so only 5.9.15 is a valid patched state on that branch.\"}},\n{\"@type\":\"Question\",\"name\":\"Is the XSS2Shell Nuclei template safe to run in production?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. It is GET-only and sends no login POST, no XSS payload and no exploit traffic. It reads one static Core JavaScript file plus public version markers. There is deliberately no benign-marker login probe, because esc_html() is a no-op on harmless input, so patched and unpatched hosts return identical output; the only input that discriminates is the exploit itself.\"}}\n]}\n<\/script><\/p>\n<div id=\"wp-share-button-65735\" class=\"wp-share-button theme28\"><span class=\"total-share \"><i class=\"total-count-text\">Total Share<\/i> <i class=\"total-count\">0<\/i> <\/span><a target=\"_blank\" href=\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/\" class=\"share-button share-button-65735 facebook\" id=\"facebook\" data-nonce=\"3e2b4a27e3\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Facebook<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/twitter.com\/intent\/tweet?url=https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/&amp;text=XSS2Shell%20(CVE-2026-64638):%20WordPress%20Pre-Auth%20XSS%20to%20RCE%20Detection%20with%20Nuclei\" class=\"share-button share-button-65735 twitter\" id=\"twitter\" data-nonce=\"3e2b4a27e3\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Twitter<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"http:\/\/www.reddit.com\/submit?title=XSS2Shell%20(CVE-2026-64638):%20WordPress%20Pre-Auth%20XSS%20to%20RCE%20Detection%20with%20Nuclei&amp;url=https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/\" class=\"share-button share-button-65735 reddit\" id=\"reddit\" data-nonce=\"3e2b4a27e3\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Reddit<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/www.linkedin.com\/shareArticle?url=https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/&amp;title=XSS2Shell%20(CVE-2026-64638):%20WordPress%20Pre-Auth%20XSS%20to%20RCE%20Detection%20with%20Nuclei&amp;summary=&amp;source=\" class=\"share-button share-button-65735 linkedin\" id=\"linkedin\" data-nonce=\"3e2b4a27e3\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Linkedin<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a title=\"More...\" href=\"#wp-share-button-65735\" class=\"share-button-more\"><span class=\"button-icon\"><i class=\"fa fa-plus\"><\/i><\/span><\/a><div class=\"wp-share-button-popup wp-share-button-popup-65735\"><div class=\"popup-buttons\"><span class=\"close\">X<\/span><a target=\"_blank\" href=\"mailto:?subject=XSS2Shell%20(CVE-2026-64638):%20WordPress%20Pre-Auth%20XSS%20to%20RCE%20Detection%20with%20Nuclei&amp;body=https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/\" class=\"share-button share-button-65735 email\" id=\"email\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Email<\/span>\r\n<span class=\"button-count\">0<\/span>\t\t\t\t\r\n\r\n<\/a>\r\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>XSS2Shell (CVE-2026-64638) is a pre-authentication reflected XSS on the WordPress login screen that escalates to PHP code execution against a logged-in administrator. A plain-English advisory, a ready-to-run non-destructive Nuclei detection template, the full 24-branch patched-version table, and how to detect affected WordPress at scale with Sn1per.<\/p>\n","protected":false},"author":1,"featured_media":65736,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[290,80,99,184,289,338,335],"tags":[359,378,477,475,437,476,37,366,434,438,435,474],"class_list":["post-65735","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-attack-surface-management","category-bug-bounties","category-cves","category-news","category-penetration-testing","category-threat-intelligence","category-vulnerability-scanning","tag-359","tag-attack-surface-management","tag-cross-site-scripting","tag-cve-2026-64638","tag-nuclei-template","tag-reflected-xss","tag-sn1per","tag-sn1per-pro","tag-wordpress-rce","tag-wordpress-security","tag-wordpress-vulnerability","tag-xss2shell"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"XSS2Shell (CVE-2026-64638) is a pre-auth WordPress login XSS chaining to PHP RCE. Free Nuclei template, all 24 patched versions, and how to detect it.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"xer0dayz\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Sn1perSecurity\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions\" \/>\n\t\t<meta property=\"og:description\" content=\"XSS2Shell (CVE-2026-64638) is a pre-auth WordPress login XSS chaining to PHP RCE. Free Nuclei template, all 24 patched versions, and how to detect it.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-10T21:15:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-08-10T21:15:56+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:title\" content=\"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions\" \/>\n\t\t<meta name=\"twitter:description\" content=\"XSS2Shell (CVE-2026-64638) is a pre-auth WordPress login XSS chaining to PHP RCE. Free Nuclei template, all 24 patched versions, and how to detect it.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#blogposting\",\"name\":\"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions\",\"headline\":\"XSS2Shell (CVE-2026-64638): WordPress Pre-Auth XSS to RCE Detection with Nuclei\",\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/xss2shell-cve-2026-64638.png\",\"width\":1200,\"height\":630,\"caption\":\"Sn1perSecurity advisory cover: XSS2Shell (CVE-2026-64638) pre-auth reflected XSS on the WordPress login screen escalating to PHP code execution, with a Nuclei detection template and Sn1per attack surface detection\"},\"datePublished\":\"2026-08-10T14:15:56-07:00\",\"dateModified\":\"2026-08-10T14:15:56-07:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#webpage\"},\"articleSection\":\"Attack Surface Management, Bug Bounties, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning, 2026, attack-surface-management, cross-site-scripting, cve-2026-64638, nuclei-template, reflected-xss, sn1per, sn1per pro, wordpress-rce, wordpress-security, wordpress-vulnerability, xss2shell\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"name\":\"Bug Bounties\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"position\":2,\"name\":\"Bug Bounties\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#listItem\",\"name\":\"XSS2Shell (CVE-2026-64638): WordPress Pre-Auth XSS to RCE Detection with Nuclei\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#listItem\",\"position\":3,\"name\":\"XSS2Shell (CVE-2026-64638): WordPress Pre-Auth XSS to RCE Detection with Nuclei\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"name\":\"Bug Bounties\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\",\"name\":\"Sn1perSecurity\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"email\":\"support@sn1persecurity.com\",\"foundingDate\":\"2021-10-05\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"value\":2},\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/Sn1perwhiteandcircleicontwitter.jpg\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#organizationLogo\",\"width\":500,\"height\":500,\"caption\":\"Sn1perSecurity Logo\"},\"image\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Sn1persecurity-105784611869093\",\"https:\\\/\\\/x.com\\\/sn1persecurity\",\"https:\\\/\\\/www.instagram.com\\\/sn1persecurity\",\"https:\\\/\\\/www.youtube.com\\\/sn1persecurity\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/sn1persecurity\\\/\",\"https:\\\/\\\/github.com\\\/1N3\\\/Sn1per\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/\",\"name\":\"xer0dayz\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e5f1a4e7b520f257ee62dcb2a44274bc57e37aa9fe3e3dcd511755464f80f636?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"xer0dayz\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#webpage\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/\",\"name\":\"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions\",\"description\":\"XSS2Shell (CVE-2026-64638) is a pre-auth WordPress login XSS chaining to PHP RCE. Free Nuclei template, all 24 patched versions, and how to detect it.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/xss2shell-cve-2026-64638.png\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Sn1perSecurity advisory cover: XSS2Shell (CVE-2026-64638) pre-auth reflected XSS on the WordPress login screen escalating to PHP code execution, with a Nuclei detection template and Sn1per attack surface detection\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\\\/#mainImage\"},\"datePublished\":\"2026-08-10T14:15:56-07:00\",\"dateModified\":\"2026-08-10T14:15:56-07:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"name\":\"Sn1perSecurity\",\"alternateName\":\"Sn1per\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions","description":"XSS2Shell (CVE-2026-64638) is a pre-auth WordPress login XSS chaining to PHP RCE. Free Nuclei template, all 24 patched versions, and how to detect it.","canonical_url":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#blogposting","name":"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions","headline":"XSS2Shell (CVE-2026-64638): WordPress Pre-Auth XSS to RCE Detection with Nuclei","author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png","width":1200,"height":630,"caption":"Sn1perSecurity advisory cover: XSS2Shell (CVE-2026-64638) pre-auth reflected XSS on the WordPress login screen escalating to PHP code execution, with a Nuclei detection template and Sn1per attack surface detection"},"datePublished":"2026-08-10T14:15:56-07:00","dateModified":"2026-08-10T14:15:56-07:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#webpage"},"isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#webpage"},"articleSection":"Attack Surface Management, Bug Bounties, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning, 2026, attack-surface-management, cross-site-scripting, cve-2026-64638, nuclei-template, reflected-xss, sn1per, sn1per pro, wordpress-rce, wordpress-security, wordpress-vulnerability, xss2shell"},{"@type":"BreadcrumbList","@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress#listItem","position":1,"name":"Home","item":"https:\/\/sn1persecurity.com\/wordpress","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","name":"Bug Bounties"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","position":2,"name":"Bug Bounties","item":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#listItem","name":"XSS2Shell (CVE-2026-64638): WordPress Pre-Auth XSS to RCE Detection with Nuclei"},"previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#listItem","position":3,"name":"XSS2Shell (CVE-2026-64638): WordPress Pre-Auth XSS to RCE Detection with Nuclei","previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","name":"Bug Bounties"}}]},{"@type":"Organization","@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization","name":"Sn1perSecurity","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","url":"https:\/\/sn1persecurity.com\/wordpress\/","email":"support@sn1persecurity.com","foundingDate":"2021-10-05","numberOfEmployees":{"@type":"QuantitativeValue","value":2},"logo":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1perwhiteandcircleicontwitter.jpg","@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#organizationLogo","width":500,"height":500,"caption":"Sn1perSecurity Logo"},"image":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","https:\/\/x.com\/sn1persecurity","https:\/\/www.instagram.com\/sn1persecurity","https:\/\/www.youtube.com\/sn1persecurity","https:\/\/www.linkedin.com\/in\/sn1persecurity\/","https:\/\/github.com\/1N3\/Sn1per"]},{"@type":"Person","@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author","url":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/","name":"xer0dayz","image":{"@type":"ImageObject","@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/e5f1a4e7b520f257ee62dcb2a44274bc57e37aa9fe3e3dcd511755464f80f636?s=96&d=mm&r=g","width":96,"height":96,"caption":"xer0dayz"}},{"@type":"WebPage","@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#webpage","url":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/","name":"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions","description":"XSS2Shell (CVE-2026-64638) is a pre-auth WordPress login XSS chaining to PHP RCE. Free Nuclei template, all 24 patched versions, and how to detect it.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#website"},"breadcrumb":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#breadcrumblist"},"author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"creator":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png","@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#mainImage","width":1200,"height":630,"caption":"Sn1perSecurity advisory cover: XSS2Shell (CVE-2026-64638) pre-auth reflected XSS on the WordPress login screen escalating to PHP code execution, with a Nuclei detection template and Sn1per attack surface detection"},"primaryImageOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/#mainImage"},"datePublished":"2026-08-10T14:15:56-07:00","dateModified":"2026-08-10T14:15:56-07:00"},{"@type":"WebSite","@id":"https:\/\/sn1persecurity.com\/wordpress\/#website","url":"https:\/\/sn1persecurity.com\/wordpress\/","name":"Sn1perSecurity","alternateName":"Sn1per","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","inLanguage":"en-US","publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"}}]},"og:locale":"en_US","og:site_name":"Sn1perSecurity","og:type":"article","og:title":"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions","og:description":"XSS2Shell (CVE-2026-64638) is a pre-auth WordPress login XSS chaining to PHP RCE. Free Nuclei template, all 24 patched versions, and how to detect it.","og:url":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/","og:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png","og:image:secure_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png","og:image:width":"1200","og:image:height":"630","article:published_time":"2026-08-10T21:15:56+00:00","article:modified_time":"2026-08-10T21:15:56+00:00","article:publisher":"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","twitter:card":"summary_large_image","twitter:site":"@sn1persecurity","twitter:title":"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions","twitter:description":"XSS2Shell (CVE-2026-64638) is a pre-auth WordPress login XSS chaining to PHP RCE. Free Nuclei template, all 24 patched versions, and how to detect it.","twitter:creator":"@sn1persecurity","twitter:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png"},"aioseo_meta_data":{"post_id":"65735","title":"XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions","description":"XSS2Shell (CVE-2026-64638) is a pre-auth WordPress login XSS chaining to PHP RCE. Free Nuclei template, all 24 patched versions, and how to detect it.","keywords":null,"keyphrases":{"focus":{"keyphrase":"xss2shell nuclei","score":0,"analysis":[]}},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png","og_image_width":"1200","og_image_height":"630","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"summary_large_image","twitter_image_type":"featured","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":true,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-08-10 21:15:59","updated":"2026-08-11 01:14:42","seo_analyzer_scan_date":null,"focus_keyword":"xss2shell nuclei","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/\" title=\"Bug Bounties\">Bug Bounties<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tXSS2Shell (CVE-2026-64638): WordPress Pre-Auth XSS to RCE Detection with Nuclei\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/sn1persecurity.com\/wordpress"},{"label":"Bug Bounties","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/"},{"label":"XSS2Shell (CVE-2026-64638): WordPress Pre-Auth XSS to RCE Detection with Nuclei","link":"https:\/\/sn1persecurity.com\/wordpress\/xss2shell-cve-2026-64638-wordpress-rce-detection-with-nuclei\/"}],"jetpack_shortlink":"https:\/\/wp.me\/pdnW96-h6f","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack-related-posts":[],"jetpack_featured_media_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/08\/xss2shell-cve-2026-64638.png","_links":{"self":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/65735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/comments?post=65735"}],"version-history":[{"count":0,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/65735\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media\/65736"}],"wp:attachment":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media?parent=65735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/categories?post=65735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/tags?post=65735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}