xss2shell-check

Non-destructive, dependency-free detector for the CVE-2026-64638 ("XSS2Shell") reflection primitive in WordPress wp-login.php.

Background

CVE-2026-64638 is a pre-authentication reflected XSS in WordPress core, disclosed by PWN.AI on 2026-08-07 (CVSS 8.9, CWE-79) and patched in 7.0.3 with backports to every maintained branch (6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, …).

The root cause is a parser differential between PHP's strip_tags() and WordPress's KSES sanitizer:

• strip_tags() refuses to recognize a tag when whitespace follows <, so a username like < area id=x> survives as plain text.
• KSES has no such rule and re-parses the text into a live <area id="x"> element inside the login error message.

That yields attacker-chosen DOM injection with chosen id/class/href attributes — the primitive behind the published multi-stage chain (DOM clobbering → REST JSONP → Application Password theft → plugin upload → RCE against a logged-in admin victim).

What this tool does

Two non-destructive probes (a failed login with a random marker username):

1. RAW_HTML — <b>marker</b> appears unescaped in the error response.
2. AREA_BYPASS — < area id=marker> survives strip_tags() and reappears as a live/normalized element (e.g. area id="marker") in the response.

No payload executes anything; the tool only measures whether attacker HTML is rendered as live DOM. Optional extras:

• --version — fingerprint core version via the feed <generator> tag.
• --jsonp — verify the REST JSONP envelope (_jsonp/_envelope) used by the published chain is reachable.

Usage

python3 xss2shell_check.py https://example.com
python3 xss2shell_check.py --jsonp --verbose https://example.com
python3 xss2shell_check.py --version https://example.com
python3 xss2shell_check.py --json https://example.com

Python 3.6+, stdlib only. No dependencies.

Exit codes

Detection matrix

Detection notes

• The vulnerable signature is the normalized element (<area id="…">). Attribute quoting varies by KSES generation (old custom parser: <area id=x>; DOMDocument: <area id="x"> / <area id="x" />), so all forms are matched. A raw < area …> passthrough without re-parsing is inert text in the browser, not the primitive — it is reported as RAW_TEXT_ONLY and does not trigger a false positive.
• The version label is advisory only: patched backports (6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 4.7.34, …) fall inside the 4.7.0–7.0.2 series and are accounted for per branch; the reflection check stays authoritative.
• Requests: 1 GET (login page — also captures WAF/sticky cookies and the effective URL after redirects) + 2 POSTs with unique random markers. POST redirects are re-issued as POST. WAF blocks surface as exit 2, not as a silent "not vulnerable".
• A false negative is possible if a custom login_errors filter or CDN/WAF rewrites responses, or the login error never echoes the username.

Disclaimer

Authorized security testing only. This tool is intended exclusively for testing systems you own or have explicit written permission to assess. Unauthorized testing is illegal in most jurisdictions.

References

• Criminal IP — WordPress Vulnerability CVE-2026-64638: Login Page XSS to Server-Side Code Execution
• CUHK ITS — WordPress Pre-Authenticated XSS Vulnerability "XSS2Shell" (CVE-2026-64638)

License

MIT