CVE-2026-64638 Cross-site scripting in WordPress
Attackers can execute arbitrary code or take over accounts via reflected XSS on the login screen, requiring victim interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-64638?
CVE-2026-64638 is a high-severity cross-site scripting vulnerability in WordPress, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
Weakness: CWE-79
Which versions are affected by CVE-2026-64638?
How do I fix CVE-2026-64638?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-64638 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-64638 exists.
Public exploit code: 1 Nuclei template and 27 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2026-64638, UBUNTU-CVE-2026-64638.