CVE-2026-64638

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

EUVD-2026-54565

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

CVE-2026-64638

WordPress Core suffers a pre-auth reflected XSS on wp-login.php that can escalate to RCE via an attacker-controlled page, in a chain dubbed XSS2Shell. The attack requires social engineering and explicit user interaction, and can affect all versions before the emergency 7.0.3 patch (backported to ...

CVE-2026-64638

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

Exploit for CVE-2026-64638

XSS2Shell XSS2Shell is an educational proof of concept for...

Exploit for CVE-2026-64638

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

Exploit for CVE-2026-64638

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

Exploit for CVE-2026-64638

XSS2Shell — PoC de CVE-2026-64638 Proof of Concept educativ...

EUVD-2026-54510

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting XSS through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the pa...

CVE-2026-48093

CVE-2026-48093 affects the Code Embed WordPress plugin (pre-2.6.1). The vulnerability is a stored XSS in the external URL embed feature used in post content: the code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without ou...

CVE-2026-48094

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress has fixed a pre-authentication reflected cross-site scripting XSS flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an...

CVE-2026-48094

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

CVE-2026-48094

CVE-2026-48094 affects the ShareOpenly WordPress plugin (prior to 1.2.1). The issue is a Cross-Site Scripting (XSS) vulnerability caused by omitting WordPress esc_url() when rendering a URL into an HTML href. The vulnerable code builds the URL from home_url( add_query_arg( array(), $wp->reques...

CVE-2026-48094 ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

EUVD-2026-54477

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

CVE-2026-48094 ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Alfath Marchdika Cahyatullah in WordPress Plugin AfterShip Tracking versions = 1.18.1...

OESA-2026-3240 perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...

OESA-2026-3239 perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...