CVE-2026-64638

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 7.0.3

Description WordPress contains a pre-authentication reflected cross-site scripting (XSS) issue on the login screen. The root cause is a discrepancy between two sanitizers regarding HTML tag identification, where certain malformed tags pass through the first sanitizer and are normalized into valid elements by the second. This allows for HTML injection, which can be escalated to script execution using DOM clobbering and JSONP responses. An attacker can host a malicious third-party website to execute this chain, potentially escalating the XSS to remote code execution (RCE) if a logged-in administrator interacts with the page, allowing the attacker to upload a shell as a plugin. Over 500 million sites are estimated to be at risk. The issue is located in the wp-login.php file.

Recommendations Update WordPress to version 7.0.3 or the latest patched version for your specific branch (backported to versions as old as 4.7).