{"uuid": "6889dfd0-4f6b-4f8c-9c57-7bb8c515b37a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/48312", "content": "\ud83d\udc80 CVE-2026-64638: XSS2Shell (WP login XSS to RCE)WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker\ud83d\udee0\ufe0f \n\nTOOLS:\n\nNuclei Template (Detection): https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64638.yaml\n\nExploit Tool (xss2shell): https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-\n\n\ud83d\udca5 IMPACT: Pre\u2011auth XSS \u2192 RCE. No credentials needed. Over 500M sites at risk.", "creation_timestamp": "2026-09-03T00:00:52.642558Z"}