XSS2Shell

XSS2Shell XSS2Shell è una prova di concetto educativa per CVE-2026-64638 , che dimostra l'impatto di un problema XSS pre-autenticazione nelle installazioni WordPress vulnerabili. Con la partecipazione esplicita di un amministratore, la PoC acquisisce una Application Password di WordPress, pubblic...

xss2shell-check

xss2shell-check Nicht-destruktiver Detektor ohne Abhängigkeiten für das Reflection-Primitive CVE-2026-64638 „XSS2Shell" in WordPress wp-login.php. Hintergrund CVE-2026-64638 ist eine vor der Authentifizierung ausnutzbare, reflektierte XSS-Schwachstelle im WordPress-Core , die von PWN.AI am...

CVE-2026-64638

Requisito Node .js Comando node evilngrok.js...

XSS2Shell

XSS2Shell ULTIMATE v3.0 Catena di exploit WordPress Pre-Auth XSS → RCE Sviluppato da G0D150NE 📌 Funzionalità 🔍 Rilevamento automatico di XSS e versione di WordPress 🎯 3 Modalità: Auto, XSS, Diretta 📡 Server di callback per intercettare le credenziali 🐚 WebShell con molteplici metodi di esecuzione...

XSS2Shell-CVE-2026-64638

🔍 @Mr-LeonardoGomes 💀 XSS2Shell-CVE-2026-64638 XSS2Shell Scanner Multi-Target Sviluppatore: Credito: YogaGymn Utilità PoC/scanning per test di sicurezza autorizzati su WordPress. Il progetto contiene un flusso di sfruttamento per un target singolo e una modalità solo scan multi-target concorrente...

XSS2Shell-CVE-2026-64638

Questo repository non contiene un README...

Cve-2026-64638

Cve-2026-64638 Nur für Bildungszwecke!...

Exploit for CVE-2026-64638

Cve-2...

Exploit for CVE-2026-64638

No d...

xss2shell-pro

XSS2Shell PRO v4.0 — WordPress XSS→RCE Automated Testing Platf...

Exploit for CVE-2026-64638

Require...

WordPress XSS2Shell 4.7.0 < 4.7.34 / 4.8.0 < 4.8.29 / 4.9.0 < 4.9.30 / 5.0.0 < 5.0.26 / 5.1.0 < 5.1.23 / 5.2.0 < 5.2.25 / 5.3.0 < 5.3.22 / 5.4.0 < 5.4.20 / 5.5.0 < 5.5.19 / 5.6.0 < 5.6.18 / 5.7.0 < 5.7.16 / 5.8.0 < 5.8.14 / 5.9.0 < 5.9.14 / 6.0.0 < 6.0.13 / 6.1.0 < 6.1.11 / 6.2.0 < 6.2.10 / 6.3.0 < 6.3.9 / 6.4.0 < 6.4.9 / 6.5.0 < 6.5.9 / 6.6.0 < 6.6.6 / 6.7.0 < 6.7.6 / 6.8.0 < 6.8.7 / 6.9.0 < 6.9.6 / 7.0.0 < 7.0.3 Login Screen XSS

The version of WordPress installed on the remote host is 4.7.x prior to 4.7.34, or 4.8.x prior to 4.8.29, or 4.9.x prior to 4.9.30, or 5.0.x prior to 5.0.26, or 5.1.x prior to 5.1.23, or 5.2.x prior to 5.2.25, or 5.3.x prior to 5.3.22, or 5.4.x prior to 5.4.20, or 5.5.x prior to 5.5.19, or 5.6.x...

Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core

TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. WordPress fixed the issue in 7.0.3 and...

[SECURITY] [DSA 6427-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6427-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2026 https://www.debian.org/security/faq -...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concep...

Exploit for CVE-2026-64638

💥 CVE‑2026‑64638 – WordPress XSS2Shell S...

Exploit for CVE-2026-64638

XSS2Shell Alert PoC CVE-2026-64638 WordPress Pre-Auth Ref...

Exploit for CVE-2026-64638

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress has fixed a pre-authentication reflected cross-site scripting XSS flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an...

Linux Distros Unpatched Vulnerability : CVE-2026-64638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an...