## https://sploitus.com/exploit?id=7FF6B97D-7947-5824-9401-77E2EA9BE420
# XSS2Shell Alert PoC (CVE-2026-64638)
**WordPress Pre-Auth Reflected XSS Proof of Concept**
Single-file HTML proof of concept for the **CVE-2026-64638** (XSS2Shell) parser-differential XSS in WordPress Core. Demonstrates unauthenticated JavaScript execution in the WordPress origin via a crafted login request.
---
## Vulnerability Information
- **CVE**: CVE-2026-64638 (XSS2Shell)
- **Type**: Pre-Auth Reflected XSS (parser differential: `strip_tags()` vs `wp_kses_post()`)
- **Escalation**: Can be chained to RCE (DOM clobbering → REST JSONP → SOME → Application Password → plugin upload)
- **Affected**: WordPress 6.4 – 7.0.2 (practically exploitable range)
- **Fixed**: WordPress 7.0.3 (backported to maintained branches down to 4.7)
---
## Usage
1. Open `POC.html` in a text editor.
2. Replace `http://TARGET/wp-login.php` in the form `action` with your target.
```html
```
3. Open the file in a browser. The form auto-submits; if the target is vulnerable, a `confirm()` (or `alert()`) popup fires in the WordPress origin.
### PoC payload
```html
X
```
The space after each `<` is the exploit. Without it, `wp_strip_all_tags()` removes everything.
---
## Requirements
- A vulnerable WordPress installation (6.4 – 7.0.2, unpatched)
- A browser with JavaScript enabled
- No tooling dependencies (pure HTML)
---
## Detection / Mitigation
- Upgrade to WordPress **7.0.3** or a patched branch.
- Revoke/rotate all existing Application Passwords after patching.
- Block `%3C` + whitespace patterns in the `log` field at the WAF/edge.
- Monitor `POST /wp-login.php` requests where `log` contains encoded `<`.
---
## References
- [pwn.ai — XSS2Shell: WordPress Preauth XSS to RCE Chain](https://pwn.ai/blog/xss2shell)
- [WordPress 7.0.3 Release](https://wordpress.org/news/2026/08/wordpress-7-0-3-release/)
- [Hadrian — CVE-2026-64638 analysis](https://hadrian.io/blog/wordpress-xss2shell-unauthenticated-login-screen-xss-to-php-code-execution-cve-2026-64638)
- [IONSEC — XSS2Shell technical analysis](https://www.ionsec.io/resources/xss2shell-wordpress-pre-auth-xss-to-rce/)