## https://sploitus.com/exploit?id=997C2594-EFDD-5E85-BDF6-66EDF4485B14
# CVE-2026-64638 — XSS2Shell PoC
Proof-of-concept tool for testing **CVE-2026-64638**, a pre-authentication reflected XSS vulnerability affecting vulnerable WordPress installations.
The tool performs vulnerability fingerprinting and validation and can generate a browser-based PoC for authorized security testing.
> **Disclaimer:** This project is intended strictly for authorized penetration testing, security research, and bug bounty programs where explicit permission has been granted. Do not use it against systems you do not own or have permission to test.
## Requirements
* Python 3
* `requests`
Install dependencies:
```bash
pip install -r requirements.txt
```
Or:
```bash
pip install requests
```
## Usage
### Basic vulnerability check
```bash
python3 xss2shell_poc.py -t https://target.com --check-only
```
### Full PoC
Performs the checks and generates an HTML PoC:
```bash
python3 xss2shell_poc.py -t https://target.com
```
### WAF variant
```bash
python3 xss2shell_poc.py -t https://target.com --variant waf
```
### Envelope variant
Use when the REST endpoint returns an HTTP 401 response:
```bash
python3 xss2shell_poc.py -t https://target.com --variant envelope
```
### Custom output filename
```bash
python3 xss2shell_poc.py -t https://target.com -o poc.html
```
## Validation Phases
The tool performs several validation stages:
| Phase | Description |
| ----- | -------------------------------------------------------- |
| 1 | Fingerprints the WordPress version |
| 2 | Confirms `wp-login.php` is reachable |
| 3 | Sends the crafted username payload and checks reflection |
| 4 | Tests the REST JSONP callback path |
| 5 | Generates PoC/report artifacts |
## Payload Variants
| Variant | Purpose |
| ---------- | ------------------------------------------------------------------ |
| `standard` | Default validation payload |
| `envelope` | Alternative REST JSONP path |
| `waf` | Alternative REST endpoint intended for environments with filtering |
## Example Output
```text
Target : https://target.com
Variant : standard
Mode : Full PoC
[>] Phase 1 — WordPress Version Fingerprint
[+] WordPress 7.0.2 — VULNERABLE
[>] Phase 2 — Confirm Login Page
[+] wp-login.php reachable
[>] Phase 3 — Testing XSS Payload
[+] XSS PAYLOAD SURVIVED SANITIZATION!
[>] Phase 4 — REST API JSONP Callback Check
[+] REST JSONP callback works
```
## Generated Artifacts
When a vulnerability is detected, the tool can generate:
* HTML PoC
* cURL reproduction command
* Manual verification information
* Bug bounty report snippet
Generated PoC files should be reviewed before sharing or committing them to a public repository.
## Affected Versions
According to the vulnerability information used by this PoC, affected versions include WordPress versions prior to the security fix.
Always verify the affected-version range against the current vendor advisory before relying on this tool for production assessments.
## Responsible Use
Use this project only when you have explicit authorization.
Do not:
* Test third-party systems without permission
* Deploy generated payloads against unauthorized targets
* Attempt destructive exploitation
* Use the tool to obtain unauthorized access
* Commit credentials, tokens, cookies, or client data
## Disclaimer
The author is not responsible for misuse of this software. The user is responsible for ensuring that testing is legally authorized and within the scope of the applicable security program.