## https://sploitus.com/exploit?id=F1F0AEBF-A67F-581A-A118-88FDB947C012
# CVE-2026-64638 — XSS2Shell Proof of Concept
A proof-of-concept (PoC) tool for validating **CVE-2026-64638**, a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability affecting WordPress installations (versions 6.4 – 7.0.2).
## Overview
This tool automates the process of fingerprinting, validating, and generating a PoC for CVE-2026-64638. It safely confirms whether a target WordPress installation is vulnerable to the pre-authentication reflected XSS without deploying malicious payloads. If the target is confirmed vulnerable, it can generate an HTML PoC for authorized security testing and inclusion in bug bounty reports.
## Features
- **Version Fingerprinting:** Accurately detects the target WordPress version using multiple heuristics.
- **Safe Validation:** Tests payload reflection and REST API JSONP endpoints to confirm exploitability safely.
- **Artifact Generation:** Automatically generates HTML PoC files, curl reproduction commands, and report snippets.
- **Payload Variants:** Supports multiple bypass variants (`standard`, `envelope`, `waf`) to test different filtering scenarios.
## Architecture / How It Works
1. **Fingerprinting:** Identifies the WordPress version via generator tags, `readme.html`, or enqueued script parameters.
2. **Endpoint Validation:** Confirms that `wp-login.php` is reachable and functional.
3. **Payload Reflection Check:** Sends a crafted username payload to `wp-login.php` and checks if the required DOM elements (e.g., `ajaxurl`, `color-picker`) survive sanitization in the response.
4. **JSONP Callback Check:** Tests the REST API JSONP functionality to verify if JavaScript evaluation is possible, completing the chain.
5. **Report Generation:** Compiles the findings into reproducible artifacts.
## Requirements
- Python 3.x
- Supported operating systems: Linux, macOS, Windows
- Dependencies: `requests>=2.31.0`, `urllib3`
## Installation
Clone the repository and install the required dependencies:
```bash
git clone https://github.com/your-username/xss2shell-poc.git
cd xss2shell-poc
pip install -r requirements.txt
```
## Configuration
This tool does not require any environment variables or complex configuration files. All parameters are passed directly via command-line arguments.
## Usage
Run the tool with Python 3 against an authorized target.
### Basic Vulnerability Check (No PoC Generation)
```bash
python3 xss2shell_poc.py -t https://target.com --check-only
```
### Full Validation and PoC Generation
```bash
python3 xss2shell_poc.py -t https://target.com
```
### Advanced Variants
If the standard payload is blocked by a WAF or the REST endpoint returns HTTP 401, try alternative variants:
```bash
python3 xss2shell_poc.py -t https://target.com --variant waf
python3 xss2shell_poc.py -t https://target.com --variant envelope
```
### Custom PoC Filename
```bash
python3 xss2shell_poc.py -t https://target.com -o custom_poc.html
```
## Project Structure
```text
.
├── .gitignore
├── CONTRIBUTING.md
├── LICENSE
├── README.md
├── SECURITY.md
├── requirements.txt
└── xss2shell_poc.py
```
## Examples
### Example Execution Output
```text
Target : https://target.com
Variant : standard
Mode : Full PoC
[>] Phase 1 — WordPress Version Fingerprint
[+] WordPress 7.0.2 — VULNERABLE (6.4 – 7.0.2)
[>] Phase 2 — Confirm Login Page
[+] wp-login.php reachable (HTTP 200)
[>] Phase 3 — Testing XSS Payload (variant: standard)
[+] XSS PAYLOAD SURVIVED SANITIZATION!
[+] Injected DOM elements found in response: ['id="ajaxurl"', 'id="color-picker"']
[>] Phase 4 — REST API JSONP Callback Check
[+] REST JSONP callback works: https://target.com/?rest_route=/&_method=GET&_jsonp=testcb
[+] jQuery will evaluate response as script → XSS fires automatically
```
## Security
This repository contains security-related testing tools.
Please refer to [SECURITY.md](SECURITY.md) for our responsible disclosure policy and authorized use requirements.
## Limitations
- The version fingerprinting may fail if the target has implemented robust "security through obscurity" measures to hide its WordPress version.
- WAFs may block the payload reflection check even if the underlying software is vulnerable.
## Contributing
We welcome professional contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for details on our workflow, code quality standards, and submission guidelines.
## License
This project is licensed under the [MIT License](LICENSE).
## Credits / Attribution
- The vulnerability logic is based on publicly available security advisories regarding CVE-2026-64638.
- The PoC script structure and payloads were curated by the project contributors for testing purposes.
## Disclaimer
**Intended for authorized use only.**
This project is provided strictly for authorized penetration testing, security research, and bug bounty programs where explicit, written permission has been granted by the system owner. Do not use this tool against systems you do not own or have permission to test. The authors and contributors are not responsible for any misuse, damage, or legal consequences resulting from the use of this software.