{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-64638 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2026-64638 is a high-severity cross-site scripting vulnerability in WordPress, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-64638 and fix it if it is affected.\n\nWhat it is: CVE-2026-64638 is a high-severity cross-site scripting vulnerability in WordPress, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-64638 exists.\n\nAffected product: WordPress. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64638/ (Markdown: https://insights.sbomify.com/CVE-2026-64638/index.md)","id":"CVE-2026-64638","markdown":"https://insights.sbomify.com/CVE-2026-64638/index.md","name":"CVE-2026-64638","record":{"aliases":["DEBIAN-CVE-2026-64638","UBUNTU-CVE-2026-64638"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["code_execution","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"WordPress CMS","requires_auth":"none","summary":"Attackers can execute arbitrary code or take over accounts via reflected XSS on the login screen, requiring victim interaction.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"hackerone","cpe":[],"cvss":{"score":8.9,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.\r\n\r\nVia a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.\r\n\r\nThis issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.\r\n\r\nDiscovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-08-07","github_poc":27,"max_poc_stars":125,"metasploit":0,"nuclei":1,"refs":[{"date":"2026-08-07T17:07:17Z","kind":"github_poc","ref":"https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-","stars":125,"title":"XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template"},{"date":"2026-08-08T01:20:11Z","kind":"github_poc","ref":"https://github.com/imbas007/CVE-2026-64638-POC","stars":14,"title":"CVE-2026-64638: WordPress Pre-auth XSS → RCE (XSS2Shell) PoC"},{"date":"2026-08-07T17:48:46Z","kind":"github_poc","ref":"https://github.com/wordsec/XSS2Shell","stars":6,"title":"Wordpress Pre-auth XSS to RCE exploit PoC (xss2shell \u0026 CVE-2026-64638)"},{"date":"2026-08-07T23:48:18Z","kind":"github_poc","ref":"https://github.com/renzi25031469/CVE-2026-64638-WordPress-Core-XSS2Shell","stars":4,"title":"Template Nuclei para detecção não-intrusiva do XSS2Shell, um parser differential pré-autenticado no WordPress Core que permite injeção de elementos DOM na página de login, servindo de base para uma cadeia de XSS → RCE."},{"date":"2026-08-09T14:38:28Z","kind":"github_poc","ref":"https://github.com/eh-amish/CVE-2026-64638-XSS-to-Shell-PoC","stars":3,"title":null},{"date":"2026-08-09T14:50:57Z","kind":"github_poc","ref":"https://github.com/0xlipon/xss2shell","stars":3,"title":"🔥 XSS2Shell — CVE-2026-64638 Scanner \u0026 PoC Toolkit"},{"date":"2026-08-07T19:45:44Z","kind":"github_poc","ref":"https://github.com/5yu4n/CVE-2026-64638","stars":2,"title":"CVE-2026-64638"},{"date":"2026-08-08T08:51:12Z","kind":"github_poc","ref":"https://github.com/HackSpeak/CVE-2026-64638","stars":2,"title":"XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE PoC mirror — WordSec, MIT; for authorized security testing"}],"tier":"weaponised"},"has_fix":true,"headline":"Cross-site scripting in WordPress","id":"CVE-2026-64638","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"xss","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Privilege escalation in Plesk","id":"CVE-2026-64639"},"packages":[],"prev":{"headline":"Privilege escalation in Plesk","id":"CVE-2026-64637"},"products":["WordPress"],"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-07","vendors":["WordPress"]},"summary":"Attackers can execute arbitrary code or take over accounts via reflected XSS on the login screen, requiring victim interaction.","url":"https://insights.sbomify.com/CVE-2026-64638/"}