Skip to content
KitploitKITPLOIT
أدواتالمدونة
إرسال
أدواتالمدونة
إرسال

أدوات الاختراق واختبار الاختراق والأمن السيبراني لترسانتك الأمنية!

Kitploit هو دليل لأدوات الاختراق والأمن السيبراني واختبار الاختراق. اكتشف آخر تحديثات المشاريع للعثور على الثغرات وتحليل الأنظمة وأتمتة الاختبارات وتعزيز أمنك.

··الخلاصات·اتصال·الخصوصية·© 2026 Kitploit

دليل الأدوات

الفئات

عرض جميع الفئات
Loading categories
CVE-2026-64638-XSS-to-Shell-PoC — Validates pre-authentication reflected XSS in WordPress, fingerprints vulnerable versions, checks payload reflection and JSONP, and generates HTML/curl PoC artifacts. | Kitploit
أدوات/GitHubGitHub/eh-amish/cve-2026-64638-xss-to-shell-poc
Payload GenerationVulnerability AnalysisWeb Application ExploitationInformation GatheringWeb SecurityPenetration Testing
GitHubeh-amish/cve-2026-64638-xss-to-shell-poc

CVE-2026-64638-XSS-to-Shell-PoC

Validates pre-authentication reflected XSS in WordPress, fingerprints vulnerable versions, checks payload reflection and JSONP, and generates HTML/curl PoC artifacts.

الأكثر شعبية

عرض الكل →

اكتشف الأدوات الأكثر استخدامًا من قبل مجتمعنا.

استكشف جميع الأدوات

تصفح مجموعتنا من الأدوات

عرض جميع الأدوات →
عرض المستودع
31منذ شهر واحدلم تتم المراجعة بعد
مشاركة
المحتوى غير متوفر باللغة المطلوبة. عرض النسخة الإنجليزية.

CVE-2026-64638 — XSS2Shell Proof of Concept

A proof-of-concept (PoC) tool for validating CVE-2026-64638, a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability affecting WordPress installations (versions 6.4 – 7.0.2).

Python Version License

Overview

This tool automates the process of fingerprinting, validating, and generating a PoC for CVE-2026-64638. It safely confirms whether a target WordPress installation is vulnerable to the pre-authentication reflected XSS without deploying malicious payloads. If the target is confirmed vulnerable, it can generate an HTML PoC for authorized security testing and inclusion in bug bounty reports.

Features

  • Version Fingerprinting: Accurately detects the target WordPress version using multiple heuristics.
  • Safe Validation: Tests payload reflection and REST API JSONP endpoints to confirm exploitability safely.
  • Artifact Generation: Automatically generates HTML PoC files, curl reproduction commands, and report snippets.
  • Supports multiple bypass variants (, , ) to test different filtering scenarios.
Payload Variants:
standard
envelope
waf

Architecture / How It Works

  1. Fingerprinting: Identifies the WordPress version via generator tags, readme.html, or enqueued script parameters.
  2. Endpoint Validation: Confirms that wp-login.php is reachable and functional.
  3. Payload Reflection Check: Sends a crafted username payload to wp-login.php and checks if the required DOM elements (e.g., ajaxurl, color-picker) survive sanitization in the response.
  4. JSONP Callback Check: Tests the REST API JSONP functionality to verify if JavaScript evaluation is possible, completing the chain.
  5. Report Generation: Compiles the findings into reproducible artifacts.

Requirements

  • Python 3.x
  • Supported operating systems: Linux, macOS, Windows
  • Dependencies: requests>=2.31.0, urllib3

Installation

Clone the repository and install the required dependencies:

root@kitploit:~
git clone https://github.com/eh-amish/xss2shell-poc.git
cd xss2shell-poc
pip install -r requirements.txt

Configuration

This tool does not require any environment variables or complex configuration files. All parameters are passed directly via command-line arguments.

Usage

Run the tool with Python 3 against an authorized target.

Basic Vulnerability Check (No PoC Generation)

root@kitploit:~
python3 xss2shell_poc.py -t https://target.com --check-only

Full Validation and PoC Generation

root@kitploit:~
python3 xss2shell_poc.py -t https://target.com

Advanced Variants

If the standard payload is blocked by a WAF or the REST endpoint returns HTTP 401, try alternative variants:

root@kitploit:~
python3 xss2shell_poc.py -t https://target.com --variant waf
python3 xss2shell_poc.py -t https://target.com --variant envelope

Custom PoC Filename

root@kitploit:~
python3 xss2shell_poc.py -t https://target.com -o custom_poc.html

Project Structure

root@kitploit:~
.
├── .gitignore
├── CONTRIBUTING.md
├── LICENSE
├── README.md
├── SECURITY.md
├── requirements.txt
└── xss2shell_poc.py

Examples

Example Execution Output

root@kitploit:~
Target  : https://target.com
Variant : standard
Mode    : Full PoC

[>] Phase 1 — WordPress Version Fingerprint
[+] WordPress 7.0.2 — VULNERABLE (6.4 – 7.0.2)

[>] Phase 2 — Confirm Login Page
[+] wp-login.php reachable (HTTP 200)

[>] Phase 3 — Testing XSS Payload (variant: standard)
[+] XSS PAYLOAD SURVIVED SANITIZATION!
[+] Injected DOM elements found in response: ['id="ajaxurl"', 'id="color-picker"']

[>] Phase 4 — REST API JSONP Callback Check
[+] REST JSONP callback works: https://target.com/?rest_route=/&_method=GET&_jsonp=testcb
[+] jQuery will evaluate response as script → XSS fires automatically

Security

This repository contains security-related testing tools. Please refer to SECURITY.md for our responsible disclosure policy and authorized use requirements.

Limitations

  • The version fingerprinting may fail if the target has implemented robust "security through obscurity" measures to hide its WordPress version.
  • WAFs may block the payload reflection check even if the underlying software is vulnerable.

Contributing

We welcome professional contributions! Please see CONTRIBUTING.md for details on our workflow, code quality standards, and submission guidelines.

License

This project is licensed under the MIT License.

Credits / Attribution

  • The vulnerability logic is based on publicly available security advisories regarding CVE-2026-64638.
  • The PoC script structure and payloads were curated by the project contributors for testing purposes.

Disclaimer

Intended for authorized use only. This project is provided strictly for authorized penetration testing, security research, and bug bounty programs where explicit, written permission has been granted by the system owner. Do not use this tool against systems you do not own or have permission to test. The authors and contributors are not responsible for any misuse, damage, or legal consequences resulting from the use of this software.

تنزيل الأداة