XSS in Wordpress
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with con…
Vulnerability class: XSS (Cross-Site Scripting)
Affected products
- Wordpress — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2026-64638?
- CVE-2026-64638 is a vulnerability in Wordpress, classified under Cross-site Scripting. Published 2026-08-07.
- Is CVE-2026-64638 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.